Splunk Search

Trying to dur2sec a HH field that is more than 24H

wweiland
Contributor

I'm trying to dur2sec a hour field that is more than 24H and therefore doesn't work. Anyone have any suggestions on how I can get the seconds out of this type of HH:MM:SS?

Below is a sample output showing that below 24H works fine, everything above fails.

walltime wall
24:00:03

23:59:46 86386

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

You can do it manually;

blah blah | rex field=your_time_field "(?<HH>\d+):(?<MM>\d+):(?<SS>\d+)" | eval dur = (HH * 3600) + (MM * 60) + SS | table your_time_field dur

/K

View solution in original post

sowings
Splunk Employee
Splunk Employee

I think dur2sec might be aimed at something like a sendmail (x)delay field, where values over 24 hours are converted to days+HH:MM:SS. I'd go with @kristian.kolb 's solution shown below.

0 Karma

kristian_kolb
Ultra Champion

You can do it manually;

blah blah | rex field=your_time_field "(?<HH>\d+):(?<MM>\d+):(?<SS>\d+)" | eval dur = (HH * 3600) + (MM * 60) + SS | table your_time_field dur

/K

wweiland
Contributor

Thank you for your help!

0 Karma

wrighke
Explorer

Just want to add, if your timestamp included milliseconds, you can use:

| rex field=diff "(?\d+):(?\d+):(?\d+).(?\d+)"
| eval dur = (HH * 3600) + (MM * 60) + SS + (MS / 1000000)

my timestamp had 6 decimal places for ms, so I divide ms by 1,000,000

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...