topic Re: Trying to get the correct format for start and end time in Splunk Enterprise

Trying to get the correct format for start and end time

chinmay25 — Mon, 22 Jun 2020 20:56:17 GMT

I am working with the following query....however, the start time and end tied output that i am getting is below and some of the times is listed several times.

06/22/2020 15:24:06.370000

I am trying to get only the time instead of the current format.

index= XYZ SMF30JBN=M*DDD* SMF30JNM=JOB* (SMF30STP=1 OR SMF30STP=5) sourcetype="syncsort:smf030"
| rename SMF30JNM as JOBNUMBER SMF30JBN as JOBNAME
| eval START = case(SMF30STP=1,strptime(DATETIME, "%Y-%m-%d %H:%M:%S.%2N"))
| eval END = case(SMF30STP=5,strptime(DATETIME, "%Y-%m-%d %H:%M:%S.%2N"))
| stats values(START) as START values(END) as END by JOBNUMBER JOBNAME
| convert dur2sec(START) as STARTTIME dur2sec(END) as ENDTIME
| convert ctime(STARTTIME) as START_TIME ctime(ENDTIME) as END_TIME
| table JOBNAME START_TIME END_TIME

Re: Trying to get the correct format for start and end time

anilchaithu — Mon, 22 Jun 2020 21:42:54 GMT

@chinmay25

one solution would be using the below command instead of convert

| eval START_TIME=strftime(START , "%H:%M:%S), END_TIME=strftime(END , "%H:%M:%S)

| table JOBNAME START_TIME END_TIME

The multiple values are due to the below command

| stats values(START) as START values(END) as END by JOBNUMBER JOBNAME

Re: Trying to get the correct format for start and end time

chinmay25 — Tue, 23 Jun 2020 16:35:07 GMT

Hi Anil,

Thank you for the help. It gave the desired output for the time format.

However, if i remove the stats command to remove the duplicates of time... most of my data is missing with either start time or end time.

start time	end time
6:55:53
6:55:33
	6:55:32
6:54:49
	6:54:48

Where as if i keep the stats command I see the result where some of the time is showing multiple events.

ex.

8:40:42

Re: Trying to get the correct format for start and end time

anilchaithu — Tue, 23 Jun 2020 16:53:56 GMT

@chinmay25

you can use mvdedup after stats to remove duplicate values.

eval START_TIME=mvdedup(START_TIME), END_TIME=mvdedup(END_TIME)

also you can use list in place of values

| stats list(START) as START list(END) as END by JOBNUMBER JOBNAME

If this helps, upvote would be appreciated

Re: Trying to get the correct format for start and end time

chinmay25 — Tue, 23 Jun 2020 17:11:42 GMT

Hi Anil,

The latest suggestion didnt help. But thanks for the earlier helped and I will vote.

Chinmay.