How to convert the search results in seconds to hours and minutes?
This my search:
index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user | table user URL MB duration(Sec)
![alt text][1]
Thank you in advance!
[1]: /storage/temp/141198-splunk-1.png
↧