| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60
Both of these work I just have 1 small issue as follows
won't display when:
1 hour NOT hours
1 Minute NOT Minutes.
1 day NOT days
Really grateful for the help so far guys
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60
@ITWhisperer Thankyou, works perfectly.
| makeresults
| eval date="13 Days, 8 Hours, 34 Minutes"
| rex field=date "(?<Days>\d+)\s+Days\,\s+(?<Hours>\d+)\s+Hours\,\s+(?<Minutes>\d+)\s+Minutes"
| eval seconds=(Days*86400)+(Hours*3600)+(Minutes*60)
| fields - Days,Hours,Minutes
| rex field=time "(?<days>\d+) Days, (?<hours>\d+) Hours, (?<minutes>\d+) Minutes" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60
@ITWhisperer the time is an example I have multiple rows where the time differs.
Ideally I would just like to add an extra field that displays in seconds
example:
date date2(new field)
0 Days, 0 Hours, 26 Minutes 1560
0 Days, 0 Hours, 27 Minutes 1620
0 Days, 0 Hours, 26 Minutes 1560
tia