Splunk Search

How to extract days ,hours minutes and secs??

chitreshakumar
Communicator

I have got the duration in this format 11+09:45:25.591549.I want to convert it to 11 days 9 hours 45 mins 25 secs.

Tags (3)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Here's one way...

| makeresults 
| eval myfield1="11+09:45:25.591549" 
| eval myfield2=myfield1 
| rex mode=sed field=myfield2 "s/(\d+)\+(\d+):(\d+):(\d+).(\d+)/\1 days \2 hours \3 mins \4 secs/g"
| table myfield1 myfield2

Above method assumes you will always have all pieces. If you will occasionally have durations that are shorter than a day and have zero days, zero hours or whatever, then you need to define what you want to receive.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Here's one way...

| makeresults 
| eval myfield1="11+09:45:25.591549" 
| eval myfield2=myfield1 
| rex mode=sed field=myfield2 "s/(\d+)\+(\d+):(\d+):(\d+).(\d+)/\1 days \2 hours \3 mins \4 secs/g"
| table myfield1 myfield2

Above method assumes you will always have all pieces. If you will occasionally have durations that are shorter than a day and have zero days, zero hours or whatever, then you need to define what you want to receive.

0 Karma

chitreshakumar
Communicator

Hi DalJeanis ,

There are some field values like this 00:00:10.000000 which I want to convert it to days , hours ,minutes and secs
Any way we can add " "00+" 00:00:10.000000"

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

That should be something like this

 | makeresults 
 | eval myfield1="11+09:45:25.591549 00:00:10.000000"
 | makemv myfield1
 | mvexpand myfield1 
 | eval myfield2=myfield1 
 | rex mode=sed field=myfield2 "s/((\d+)\+)?(\d+):(\d+):(\d+).(\d+)/\2 days \3 hours \4 mins \5 secs/g s/^ /0 /g s/00/0/g"
 | table myfield1 myfield2
0 Karma

493669
Super Champion
rex field=<duration_field_name> "(?<DAYS>\d+).(?<Hours>\d+).(?<Mins>\d+).(?<Secs>\d+)"|table DAYS, Hours, Mins, Secs

replace <duration_field_name> with your duration field name

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...