Splunk Search

Convert negative seconds to duration

joxley
Path Finder

I have a column of seconds, some of which are negative (representing an outage). I want to use tostring(duration, "duration") on the column, but that doesn't work

| stats count | eval count=-5 | eval duration=tostring(count, "duration")
1 Solution

joxley
Path Finder

Absolute the duration in the conversion and prepend it with a - or empty string.

| stats count | eval count=-5 | eval duration=if(count<0, "-", "") + tostring(abs(count), "duration")

View solution in original post

0 Karma

joxley
Path Finder

Absolute the duration in the conversion and prepend it with a - or empty string.

| stats count | eval count=-5 | eval duration=if(count<0, "-", "") + tostring(abs(count), "duration")
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...