Splunk Search

Minutes and seconds formating

gravi
Explorer

I have a field that sends time in Min&sec in the format 3m7s

I want it to be in the format 3.07

Tried using the below eval but the result is null.

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%M%S"),"%M.%S")

Could you please help?

Thanks

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="7h13m17s, 4m6s" 
| makemv delim="," temp 
| mvexpand temp 
| rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s" 
| eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes) 
| eval result = minutes.".".printf("%02d",seconds) |table temp, result
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think | eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S") will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

This eval expression is returning nothing even if the input is in MmSs format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")

But if the fields is in HhMmSs the below eval expression is returng results in H.M.S format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%HhMm%Ss"),"%H.%M.%S")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Let's try using rex to handle the optional hours value.

| makeresults
| eval time="34m56s" 
| rex field=time "(?:(?<hr>\d+)h)?(?<min>\d+)m(?<sec>\d+)s"
| eval hr=coalesce(hr,0)
| eval ProcessingTime=hr.":".min.":".sec
| convert dur2sec(ProcessingTime) 
| eval TimeinMin=(ProcessingTime)/60 
| table time, ProcessingTime,TimeinMin
---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

Thnaks for the reply. I just realized that we have few results in MmSs format and few in HhMmSs format. It works if I have either of them but not both. Do you know if there is any generic wayto satisfy both scenarios?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...