Below is a two result conversion table. The data I am given, some will have days in the field and others will only have time. How do I setup a conversion to handle this situation. The convert auto(UpTime) works great as long as the field contains an entry with days. The rex works well, again as long as the field contains a string containing days. | makeresults | eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"] | convert auto(UpTime) AS autoDays | rex field=UpTime "(?<days>\d+):(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)" | table UpTime, autoDays, days,hours,minutes, seconds, micro Results: UpTime autoDays days hours minutes seconds micro 5:10:07:03.2419156 5 5 10 07 03 2419156 9:28:35.1006819 9
... View more