Splunk Search

How to convert string time to show the number of seconds?

tamduong16
Contributor

I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is the format of the string time:
alt text

How could I eliminate the quotes and convert it into duration.
Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

View solution in original post

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

tamduong16
Contributor

thank you so much

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try this: | makeresults | eval CallDuration = "02:30:00" | rex field=CallDuration "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval duration_minutes = ((hours*60)+minutes)

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...