I have a field that sends time in Min&sec in the format 3m7s
I want it to be in the format 3.07
Tried using the below eval but the result is null.
| eval ProcessingTime=strftime(strptime(DFLoadTime, "%M%S"),"%M.%S")
Could you please help?
Thanks
Hi
Try this
| makeresults
| eval temp="7h13m17s, 4m6s"
| makemv delim="," temp
| mvexpand temp
| rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s"
| eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes)
| eval result = minutes.".".printf("%02d",seconds) |table temp, result
I think | eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")
will work.
This eval expression is returning nothing even if the input is in MmSs
format
| eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")
But if the fields is in HhMmSs
the below eval expression is returng results in H.M.S format
| eval ProcessingTime=strftime(strptime(DFLoadTime, "%HhMm%Ss"),"%H.%M.%S")
Let's try using rex
to handle the optional hours value.
| makeresults
| eval time="34m56s"
| rex field=time "(?:(?<hr>\d+)h)?(?<min>\d+)m(?<sec>\d+)s"
| eval hr=coalesce(hr,0)
| eval ProcessingTime=hr.":".min.":".sec
| convert dur2sec(ProcessingTime)
| eval TimeinMin=(ProcessingTime)/60
| table time, ProcessingTime,TimeinMin
Thnaks for the reply. I just realized that we have few results in MmSs
format and few in HhMmSs
format. It works if I have either of them but not both. Do you know if there is any generic wayto satisfy both scenarios?