Our VPN reported total connect time in seconds but we needed something understandable for reporting purposes. @shoothub handily put it together for me in a post back in 2019:
input:
- login_ duration: 5151
output:
- vpn_connection_time: ‘1 hours, 25 minutes, 51 seconds’
rule "RA-Calc-Connect-Time"
when
has_field("login_duration") &&
to_long($message.login_duration) > 0
then
let vpn_duration = parse_unix_milliseconds(to_long($message.login_duration) * 1000);
let vpn_hours = vpn_duration.hourOfDay;
let vpn_minutes = vpn_duration.minuteOfHour;
let vpn_seconds = vpn_duration.secondOfMinute;
let build_message_0 = concat(to_string(vpn_hours), " hours, ");
let build_message_1 = concat(build_message_0, to_string(vpn_minutes));
let build_message_2 = concat(build_message_1, " minutes, ");
let build_message_3 = concat(build_message_2, to_string(vpn_seconds));
let build_message_4 = concat(build_message_3, " seconds");
set_field( field: "vpn_connection_time",
value: build_message_4
);
end