Hello
If you are getting durations like this:
"1+06:29:32"
You can use rex after getting the duration to extract the day. Like:
...| rex field="yourdurationfield" "(?<durationdays>^\d+)\+" | ...
But, for durations of less than one day you won't get any value. You will need to use fillnull after the rex command.
Regards
Hello
If you are getting durations like this:
"1+06:29:32"
You can use rex after getting the duration to extract the day. Like:
...| rex field="yourdurationfield" "(?<durationdays>^\d+)\+" | ...
But, for durations of less than one day you won't get any value. You will need to use fillnull after the rex command.
Regards
Awesome,that worked, thanks.