I'm sure this may have been asked before. When using transaction, I would like to format the duration into `H:M:S`, my search results for **jobduration** looks like 19 is being added to the result. Any help is appreciated.
Search is:
sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" | transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" | eval Date=strftime(_time, "%m-%d-%y") | eval JobDuration=strftime(duration, "%H:%M:%S") | table Date job_name JobDuration
Sample Results:
02-03-16 ELSHPCST 02:56:52
02-04-16 ELVALRTD 19:00:00
02-04-16 ELVALRTPE 19:00:00
02-04-16 ELVALOOS 19:00:00
02-04-16 ELVALRTD 19:00:00
02-04-16 ELVALRTPE 19:00:00
↧