Splunk Search

time coversion

infotork
Explorer

Can some one help me to convert  the time format ( hh:mm:ss:nnn) which in string  ( example 0:00:00.041) into seconds, the answer should be for this 0:00:00.041 is 0 seconds.

example : 1. 0:00:00.041 is 0 seconds 
                    2. 0:00:00.500 is 0.5 seconds.

                    

 

Labels (1)
0 Karma
1 Solution

yeahnah
Builder

Hi @infotork 

Here's one possible example way to do it

| makeresults 
| eval duration=split("00:00:00.500", ".")
      ,micro_secs=(tonumber(mvindex(duration, 1))/1000)
      ,duration=mvindex(duration, 0)   
| convert dur2sec(duration) AS duration_secs
| eval seconds=round((duration_secs + micro_secs), 1)

 

View solution in original post

yeahnah
Builder

Hi @infotork 

Here's one possible example way to do it

| makeresults 
| eval duration=split("00:00:00.500", ".")
      ,micro_secs=(tonumber(mvindex(duration, 1))/1000)
      ,duration=mvindex(duration, 0)   
| convert dur2sec(duration) AS duration_secs
| eval seconds=round((duration_secs + micro_secs), 1)

 

infotork
Explorer

Thank you so much,

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...