Hopefully I've only got a small problem this time, but I've had no luck fixing it despite hours of trying. All I'm trying to do is convert a string time field to unix using strptime. This is my time ...
See more...
Hopefully I've only got a small problem this time, but I've had no luck fixing it despite hours of trying. All I'm trying to do is convert a string time field to unix using strptime. This is my time field: Ended: 0d1h55m0s I've been trying to convert it to unix using the following command: | eval time_sec = strptime('Time', "Ended: %dd%Hh%Mm%Ss") For clarity, this is the full search: | inputlookup metrics.csv
| eval occurred=strftime(strptime(occurred,"%a, %d %b %Y %T %Z"), "%F %T %Z")
| eval closed=strftime(strptime(closed,"%a, %d %b %Y %T %Z"), "%F %T %Z")
| eval time_sec = strptime('Time', "Ended: %dd%Hh%Mm")
| where strptime(occurred, "%F %T") >= strptime("2025-05-01 00:00:00", "%F %T") AND (isnull(closeReason) OR closeReason="Resolved")
| fillnull value=Resolved closeReason The example time I've posted above 0d1h55m0s should ideally convert to 6900(seconds).