I have a search that creates a time in HH:MM
and looks like 04:34.000
. How can I drop the .000
at the end of this? Here is the part of my search that gets the time.
| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | eval HH:MM:SS=tostring('duration', "duration") | convert rmunit("duration") as numSecs | eval "duration" = round('duration',0) | eval stringSecs2=tostring(numSecs,"duration") | eval "Total Time in HH:MM" = replace(stringSecs2,"(\d+)\:(\d+)\:(\d+)","\1:\2")
You could use rtrim
to cut the last 3 digits
... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))
Would this work?
| eval "Total Time in HH:MM"=strptime("Total Time in HH:MM", "%H:%M")
"strptime(X,Y) This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". If timeStr is in the form, "11:59", this returns it as a timestamp:"
You could use rtrim
to cut the last 3 digits
... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))
That worked! thanks.
Try this
| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(round(duration, 0), "duration") | table duration dur_formatted
I could not get that to work. Were you say to replace what I had with that?
Replace you search with what I had
when I did that I get "no results found"