Splunk Search

Can you remove a unit of measurement from a field value?

mbond81
Engager

I'm trying to calculate man hours, but my field format is "12 Mins" not simply "12". How can I either calculate this numeric value with the unit attached, or remove the unit "Mins" and calculate the total that way?

Tags (3)
0 Karma

sansay
Contributor

The simplest flexible way:
... | convert rmunit(FieldName) | ...

mattymo
Splunk Employee
Splunk Employee

beauty command, that I didn't even know existed! thanks!

- MattyMo
0 Karma

woodcock
Esteemed Legend

Remove it like this:

... | rex field=MyField mode=sed "s/\s+Mins$//"
0 Karma

ehudb
Contributor

Lets assume your field is named "time", you can extract it with rex:

|rex field=time "(?\d+)" |stats sum(mins) as total

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...