Splunk Search

Converting Duration Field value to seconds

adityapavan18
Contributor

I have a extracted field call CallDuration and in logs it in format

%H:%M:%S.%2N like 00:00:38.60

That means the call duartion was 38.60 secs.

Now how can i convert that duartion to total number of seconds.??

If field value is 01:05:45.20
The new field should hold total duration in seconds ie. 3945.20sec

Tags (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's something to get you started:

eval duration=strptime(CallDuration,"%H:%M:%S.%2N") | eval base=strptime("00:00:00.00","%H:%M:%S.%2N") | eval secs=duration-base | table duration, secs
---
If this reply helps you, Karma would be appreciated.

View solution in original post

gpullis
Communicator

There's now a convert function for this:

... | convert dur2sec(CallDuration) AS duration

bugmenot
New Member

This answer is not valid, dur2sec does not support milliseconds. Proof: index=* | head 1 | eval CallDuration="00:00:38.60" | convert dur2sec(CallDuration) AS duration -> results in no duration field.

0 Karma

MattZerfas
Communicator

The accepted answer should now be changed to this response since it is now a thing. SOOOO much cleaner and easier.

0 Karma

MedralaG
Communicator

totally agree

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi adityapavan18,

the following searchFu are example and you need to match them to your events, but you could do something like this:

... | rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds))

or something like this if you have duration over or under one day:

... | rex field="_raw" "CallDuration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?" | eval connduration=(if(dur_day=="",0,dur_day)*1440*60)+(dur_hour * 60*60)+(dur_min*60)

hope this helps ...

cheers, MuS

richgalloway
SplunkTrust
SplunkTrust

Here's something to get you started:

eval duration=strptime(CallDuration,"%H:%M:%S.%2N") | eval base=strptime("00:00:00.00","%H:%M:%S.%2N") | eval secs=duration-base | table duration, secs
---
If this reply helps you, Karma would be appreciated.

somesoni2
SplunkTrust
SplunkTrust

If you have many places where this conversion will take place, I would suggest to create a macro for it.

MuS
SplunkTrust
SplunkTrust

that's a nice one as well and I was typing for to long 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...