topic Re: Query criteria to calculate Time Span in Splunk Dev

Query criteria to calculate Time Span

sanjayiowa — Thu, 01 Nov 2012 19:34:08 GMT

Hi,

Is there a way to calculate a time span from start to stop position using java sdk.

e.g.
11012012 12:00:01 PM Start
...
....

11012012 12:30:01 PM Stop

and
result would be 30 min.

Thanks,
Sanjay

Re: Query criteria to calculate Time Span

alacercogitatus — Thu, 01 Nov 2012 19:58:28 GMT

Are you trying to parse this from events returned from a search? Where are you getting these times from?

Re: Query criteria to calculate Time Span

sanjayiowa — Thu, 01 Nov 2012 20:02:24 GMT

Those events are in a log file. I would like to get 30 min as answer or list of those time period if there are multiple Start/Stop (matching first to first)

Re: Query criteria to calculate Time Span

alacercogitatus — Thu, 01 Nov 2012 20:33:45 GMT

If this log file is in Splunk, you could try:

search_foo | transaction host startswith="Start" endswith="Stop"

The resulting "duration" field will tell you how long it took.

http://www.splunk.com/base/Documentation/5.0/SearchReference/Transaction

Re: Query criteria to calculate Time Span

sanjayiowa — Thu, 01 Nov 2012 20:45:27 GMT

Thanks for prompt response. I was able to get desire result.

Re: Query criteria to calculate Time Span

dwaddle — Fri, 02 Nov 2012 01:48:57 GMT

If the answer solved your problem, please click the check box to the left to "accept" the answer.