Splunk Search

How to convert a string value in the format HH:mm:ss to usable seconds for a graph?

mgranger1
Path Finder

Hey Gang,

We are currently running Splunk Enterprise 6.3.1 on RHEL 6.x servers. I have a string value that I have brought in from a long that represents hours, minutes, and seconds in the form HH:mm:ss, and the user would like to graph the trend of the duration. The easiest way that I can think of to do this would be to convert this string into a number of seconds so that I could represent a single numeric value to graph. Does anyone have an easy way to do this, or an alternate way to graph HH:mm:ss? Thanks, in advance for any help you may be able to provide.

0 Karma

sundareshr
Legend

Have you tried convert command?

... | convert dur2sec(HHMMSSFormattedText) as seconds

mgranger1
Path Finder

Okay, now for a follow up. Is there a way to graph the duration in it's HH:mm:ss format? The end user doesn't like the idea of showing her management the duration in total seconds as she feels management will be confused. I know this is a long shot, but if it was 01:15:30 (i.e. one hour, fifteen minutes and 30 seconds), she would like the graph to be numbered somehow as 1:15:30 and not 4530 seconds.

0 Karma

sundareshr
Legend

Try the convert AFTER the chart command.

0 Karma

mgranger1
Path Finder

This worked like a charm. I couldn't believe it was that easy. Thank you so much for this simple and efficient answer. You've saved me a boatload of time!

0 Karma

somesoni2
Revered Legend

I think the way to go will be convert this to seconds and chart it. The value should be numerical to be charted so string formatted duration wouldn't work. Something like this should work.

your base search | eval yourDurationField=strptime("01/01/2016 ".yourDurationField,"%m/%d/%Y %H:%M:%S") - strptime("01/01/2016 ","%m/%d/%Y") | your chart command...
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!