Splunk convert extracted field in currently milliseconds to HH:MM:SS

问题

can anyone provide me with a way to have Splunk convert an extracted field which is currently in milliseconds to HH:MM:SS?

回答1:

...| fieldFormat inSeconds = tostring(inMS/1000,"duration)

where inMS is the name of the extracted field and inSeconds is the result you want

add | fields - inMS to remove the original field

来源：https://stackoverflow.com/questions/9828540/splunk-convert-extracted-field-in-currently-milliseconds-to-hhmmss