I have Cisco ASA and raw event like:
%ASA-4-113019: Group = XXX, Username = user, IP = 18.104.22.168, Session disconnected. Session Type: IKEv1, Duration: 3h:01m:44s, Bytes xmt: 26082098, Bytes rcv: 13031692, Reason: User Requested
When this event was parsing I have metakey duration.time = '10904.0'
When I create a report I wish see in the report duration as 3h:01m:44s. How I can do it?