I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is the format of the string time:
How could I eliminate the quotes and convert it into duration.
Thanks!
I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).
| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration"
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration"
I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).
| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration"
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration"
thank you so much
Try this: | makeresults | eval CallDuration = "02:30:00" | rex field=CallDuration "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval duration_minutes = ((hours*60)+minutes)