I have an issue with calculating seconds that go over 60 minutes that sums to be a few days.
One of my eval calculations sums to be 496089.166322 seconds and if I use
|fieldformat "Total Time"=strftime('Total Time', "%M:%S") I get 48:09 as the sum but should calculate to 5 days, 17 hours, 48 minutes and 9 seconds
I am not sure if I have to use a macro to do the job? LINK
Or missing something obvious?
I have searched through every variation of this and have tried all the common date and time format variables with strftime( converts epoch time to format Y )
Here is my current search string where I have to break down the Days Hours Minutes and Seconds along with a ScreenCapture
( 2222222 dest_port="") OR (1111111 src_port="") OR ( 1111111 src_ip="") OR (2222222 dest_ip="")
| eval disconnect_time=if(match(_raw,"2222222"),_time,null())
| eval connect_time=if(match(_raw,"1111111"),_time,null())
| eval Ephemeral=if(isnotnull(disconnect_time),dest_port,Ephemeral)
| eval Ephemeral=if(isnotnull(connect_time),src_port,Ephemeral)
| stats min(connect_time) as Connect max(disconnect_time) as Disconnect min(src_ip) as "Source IP" by Ephemeral
| eval Seconds=Disconnect-Connect
| fieldformat "Seconds"=strftime('Seconds', "%s")
| eval Minutes=Seconds/60 | eval Hours=Minutes/60
| eval Days=Hours/24
| convert timeformat="%a %b-%d %Y "at" %H:%M:%S" ctime(Connect) ctime(Disconnect)
| search Connect= Disconnect=
| rename Ephemeral as "Connection Port", Total_time as "lala"