Splunk Search

How do you Insert Hour, Mins & Seconds in an extracted time?

cquinney
Communicator

I have a table that populates something to the effect of:

Name           Start Time              End Time          Run Time Duration
Test               15:40:39                15:45:39                   00:05:00

What I'm trying to create is the following under Run Time Duration = 00H 05Min 00Secs

Any assistance in resolving this would be greatly appreciated.

0 Karma
1 Solution

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

View solution in original post

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

cquinney
Communicator

Works perfectly! Thank you!!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...