I realise this is getting a bit old, but in case it helps someone else (like this helped me!), I'll share my extension of this answer. I wanted to include days in the result, and remove leading zeroes from terms, and leading terms if they were zero. This is my query: | eval string_dur = tostring(round(secs), "duration") | eval formatted_dur = replace(string_dur,"(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s") | eval result=replace(formatted_dur, "^d (0h (0m )?)?","") Sample results (including intermediate strings): secs string_dur formatted_dur result ----------- ----------- --------------- --------------- 2.000 00:00:02 d 0h 0m 2s 2s 12.500 00:00:13 d 0h 0m 13s 13s 144.333 00:02:24 d 0h 2m 24s 2m 24s 1728.250 00:28:48 d 0h 28m 48s 28m 48s 20736.200 05:45:36 d 5h 45m 36s 5h 45m 36s 248832.167 2+21:07:12 2d 21h 7m 12s 2d 21h 7m 12s 2985984.143 34+13:26:24 34d 13h 26m 24s 34d 13h 26m 24s ... View more