That's solid. It worked! Thanks a lot. ... View more

I wanted to display the duration in sections for example the output will be: 8d+18H:30M:28S ... View more

@cmerriman i used the solution you provided "(split(tostring(durationseconds,"duration"),"."),0)" but this came out with very weird answers. I got answers like 6+02:23:16 9+03:34:54 4+08:55:02 6+13:22:33 5+20:20:19 8+18:30:28 5+20:20:19 8+18:30:28 I don't know how to explain 8 + 18:30:28 , where do i fit that. do i have to do more computation to sum that up again. I don't really see a documentation on SPLUNK's Docs for all of this, nothing covers how to calculate duration or the answers to expect after this is being used. Please explain this process to me, it is really vague ... View more