tostring (X, "duration") working wierd.

[sarumjanuch]

Why when i am using this function for big seconds values, i get something like: "1+06:29:32"? If this field is duration then i suspect it can have more than 24 hours. Can someone explain?

[sideview]

That string value is saying "1 day, 6 hours, 29 minutes and 32 seconds".

If you give it a value less than one day, it'll just give a more familiar: "12:30:00" meaning 12 hours and thirty minutes.

On the other hand if you give it a really really enormous value, as in this artificial search:

 | stats count | eval foo=2334121312412 | eval duration=tostring(foo,"duration")

It'll happily tell you "27015292+23:13:32 ", ie 27 million days and change.

UPDATE:

I see. If you'd prefer it to say 160:25:30 instead of 6+16:25:30, then you can use some pretty hairy eval syntax:

| eval durationStr=tostring(floor(duration/(3600))) + ":" + mvjoin(mvindex(split(tostring(duration,"duration"),":"),1,4),":")

What this does, is it manually calculates the hours on one side. On the other side it lets the tostring function do its thing, but then it clips off the left side leaving only the minutes and seconds. Glue them back together and voila.

Or if you'd prefer to do it all manually with arithmetic operators and the mod operator (%), you can do that too:

| eval durationStr=tostring(floor(duration/(3600))) + ":" + tostring(floor(duration/(60)) % 60) + ":" + tostring(duration % 60)

You probably want to save this as a macro so you can use it like

| `get_string_duration(duration)`

[sideview]

Gotcha. I updated my answer. That's possible too although it's more manual.

[jwalzerpitt]

Is there anyway to show just the hours and minutes for the duration (jettisoning the second, etc)?

I found a link here - http://answers.splunk.com/answers/97381/session-duration-in-minutes.html - which shows how to "pretty" the output, but not having luck trying to modify the query string you provided with the one provided int he link:

rename "Avg Session Duration(minutes)" AS avgSessionDuration
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"

Thx

[sarumjanuch]

Yeah, i understand this, but for examle i have CDR's application and i need to count total duration of calls, and this will be very wierd if i will post my calls duration something like this, is there any way to get this in absolute values?? for example: "160:25:30"