Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to extract the duration in seconds from values like "2 dy 13 hr 49 min 13 sec"

$
0
0
Hi, I would like to extract the duration in seconds from values like this: "2 dy 13 hr 49 min 13 sec" "1 hr 49 min 41 sec" "12 min 56 sec" For constant values (e.g. with only min & sec) I would use: "12 min 56 sec" -> | rex field="FieldA" "(?.*)\ (?.*)\ (?.*) (?.*)" But as you can see the format can be different. Is possible to convert these fields into a duration in seconds? My idea would be to extract fields for each part of the value, for example: "2 dy 13 hr 49 min 13 sec" into: dy=2 hr=13 min=49 sec=13 But I don't know how to achieve this. Can you help me? Thanks in advance Heinz

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>