Splunk Search

How to convert string time to show the number of seconds?

tamduong16
Contributor

I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is the format of the string time:
alt text

How could I eliminate the quotes and convert it into duration.
Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

View solution in original post

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

tamduong16
Contributor

thank you so much

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try this: | makeresults | eval CallDuration = "02:30:00" | rex field=CallDuration "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval duration_minutes = ((hours*60)+minutes)

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...