Splunk Search

How to convert string time to show the number of seconds?

tamduong16
Contributor

I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is the format of the string time:
alt text

How could I eliminate the quotes and convert it into duration.
Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

View solution in original post

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

tamduong16
Contributor

thank you so much

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try this: | makeresults | eval CallDuration = "02:30:00" | rex field=CallDuration "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval duration_minutes = ((hours*60)+minutes)

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...