Splunk Search

How to edit my search to remove .000 from the end of a time field (HH:MM.000)?

chadman
Path Finder

I have a search that creates a time in HH:MM and looks like 04:34.000. How can I drop the .000 at the end of this? Here is the part of my search that gets the time.

| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | eval HH:MM:SS=tostring('duration', "duration") | convert rmunit("duration") as numSecs  | eval "duration" = round('duration',0) | eval stringSecs2=tostring(numSecs,"duration") | eval "Total Time in HH:MM" = replace(stringSecs2,"(\d+)\:(\d+)\:(\d+)","\1:\2")
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You could use rtrim to cut the last 3 digits

... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))

View solution in original post

JDukeSplunk
Builder

Would this work?

| eval "Total Time in HH:MM"=strptime("Total Time in HH:MM", "%H:%M")

"strptime(X,Y) This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". If timeStr is in the form, "11:59", this returns it as a timestamp:"

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You could use rtrim to cut the last 3 digits

... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))

chadman
Path Finder

That worked! thanks.

0 Karma

sundareshr
Legend

Try this

| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(round(duration, 0), "duration") | table duration dur_formatted
0 Karma

chadman
Path Finder

I could not get that to work. Were you say to replace what I had with that?

0 Karma

sundareshr
Legend

Replace you search with what I had

0 Karma

chadman
Path Finder

when I did that I get "no results found"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...