Splunk Search

How do you Insert Hour, Mins & Seconds in an extracted time?

cquinney
Communicator

I have a table that populates something to the effect of:

Name           Start Time              End Time          Run Time Duration
Test               15:40:39                15:45:39                   00:05:00

What I'm trying to create is the following under Run Time Duration = 00H 05Min 00Secs

Any assistance in resolving this would be greatly appreciated.

0 Karma
1 Solution

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

View solution in original post

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

cquinney
Communicator

Works perfectly! Thank you!!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...