Splunk convert extracted field in currently millis

Question

can anyone provide me with a way to have Splunk convert an extracted field which is currently in milliseconds to HH:MM:SS?

Answer 1

...| fieldFormat inSeconds = tostring(inMS/1000,"duration)

where inMS is the name of the extracted field and inSeconds is the result you want

add | fields - inMS to remove the original field