Splunk Search

time coversion

infotork
Explorer

Can some one help me to convert  the time format ( hh:mm:ss:nnn) which in string  ( example 0:00:00.041) into seconds, the answer should be for this 0:00:00.041 is 0 seconds.

example : 1. 0:00:00.041 is 0 seconds 
                    2. 0:00:00.500 is 0.5 seconds.

                    

 

Labels (1)
0 Karma
1 Solution

yeahnah
Motivator

Hi @infotork 

Here's one possible example way to do it

| makeresults 
| eval duration=split("00:00:00.500", ".")
      ,micro_secs=(tonumber(mvindex(duration, 1))/1000)
      ,duration=mvindex(duration, 0)   
| convert dur2sec(duration) AS duration_secs
| eval seconds=round((duration_secs + micro_secs), 1)

 

View solution in original post

yeahnah
Motivator

Hi @infotork 

Here's one possible example way to do it

| makeresults 
| eval duration=split("00:00:00.500", ".")
      ,micro_secs=(tonumber(mvindex(duration, 1))/1000)
      ,duration=mvindex(duration, 0)   
| convert dur2sec(duration) AS duration_secs
| eval seconds=round((duration_secs + micro_secs), 1)

 

infotork
Explorer

Thank you so much,

0 Karma
Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...