Forum Discussion

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor

    findus_l 

     

    I did start to write a function for this, but never went back to it, here is where I got to (limited testing but maybe it will give you or others an idea).  It only deals with D,T,H and in a basic way.

    let a = "PD1T1H29M58.163977013S";
    // use Usage as it always exists 
    Usage
    | extend d = extract("D([0-9]+)",1,a, typeof(real)) * 1440  //convert mins 
    | extend h = extract("T([0-9]+)",1,a, typeof(real)) * 60    //convert hours to mins
    | extend m = extract("H([0-9]+)",1,a, typeof(real)) 
    | extend newDay_ = strcat(d + h + m,"m")
    | where TimeGenerated > ago(totimespan(newDay_))
    | project-away d,h,m

     

    • findus_l's avatar
      findus_l
      Copper Contributor
      Thanks. Having this extra makes a query harder to read and harder to maintain. How is there no existing function for this.

Resources