Splunk Search

How do you Insert Hour, Mins & Seconds in an extracted time?

cquinney
Communicator

I have a table that populates something to the effect of:

Name           Start Time              End Time          Run Time Duration
Test               15:40:39                15:45:39                   00:05:00

What I'm trying to create is the following under Run Time Duration = 00H 05Min 00Secs

Any assistance in resolving this would be greatly appreciated.

0 Karma
1 Solution

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

View solution in original post

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

cquinney
Communicator

Works perfectly! Thank you!!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...