Splunk Search

How to parse a time duration of the format "4s", "9.1ms", etc.

dankinder
New Member

The default duration output from go (golang) is to use a single float with one or two characters identifying the unit, ex:

56.920404ms
4.61µs
45.1s
etc.

I can't seem to find a built-in way to convert these. How can it be done?

0 Karma

lguinn2
Legend

Try this, assuming that your duration output is in a field called duration

yoursearchhere
| convert rmunit(duration) as num_duration
| rex field=duration "\d*\s*(?<units>\w+)$"
| eval secs=num_duration * case(units=="s",1,  units="ms",.001, units="µs",.000001,units=="m",60,1==1,0)

The result is a field called secs that contains the duration converted to seconds.
Clearly, I did not do all possible units, but you get the point.
AFAIK, there is no single command or function that will do what you want. You could turn this into a macro though

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...