Very interesting problem, but with simple solution. I’ve created and tried this snippet and it works as expected. I’ve used function parse_unix_milliseconds to parse number of vpn duration in seconds as unix time. After that I only extracted hours, minutes and seconds using functions hourOfDay, minuteOfDay and secondOfDay and concat in one string.
let vpn_duration = parse_unix_milliseconds(to_long($message.pulse_connectsec) * 1000);
let vpn_hours = vpn_duration.hourOfDay;
let vpn_minutes = vpn_duration.minuteOfHour;
let vpn_seconds = vpn_duration.secondOfMinute;
let build_message_0 = concat(to_string(vpn_hours), " hours, ");
let build_message_1 = concat(build_message_0, to_string(vpn_minutes));
let build_message_2 = concat(build_message_1, " minutes, ");
let build_message_3 = concat(build_message_2, to_string(vpn_seconds));
let build_message_4 = concat(build_message_3, " seconds");
set_field("pulse_Connection_Time", build_message_4);