Hi everyone,
I have calculated a duration field like this for example
Duration
00:22:02
00:19:26
00:04:26
00:20:16
00:16:47
with this search
my_search | convert num("Duration") | stats sum("Duration") as "Total" | eval "Total"=tostring($Total$,"duration")
and I have the result of this in a total of all my durations
5+17:02:53
I there a way to convert or transform this result in
5 days
17 hours
02 minutes
53 seconds
or something like this would also be great:
5 days 17:02:53'
Thank you very much!
Split into two rex in case the duration is not more than 1 day.
| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"
There is no built-in function to do that so you'll have to do it manually. Start with a simple replace:
| replace "+" with " days " in Total
For something a little more complex, try rex:
| rex field=Total "(?:(?<days>\d+)\+)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)"
| eval Total = if(isnull(days),0,days)." days ".hours." hours ".minutes." minutes ".seconds." seconds"
Split into two rex in case the duration is not more than 1 day.
| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"