https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93910#M19535 <P>Hi,</P> <P>I have a stupid question for followup <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> !</P> <P>What if the field was named accountNumber in alphalog and accountId in betalog, how would the searches that you suggested change (obviously a join is involved)</P> Mon, 21 Jan 2013 18:31:54 GMT asarolkar 2013-01-21T18:31:54Z https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93908#M19533 <P>All,</P> <P>I have two logs with <CODE>sourcetype="alphalog"</CODE> and <CODE>sourcetype="betalog"</CODE> with the generic timestamp _time present.</P> <P>I am joining them on a field called <CODE>accountId</CODE>. </P> <P>What I want to do is to be able to find the difference between the <CODE>"_time"</CODE> values if possible ?</P> <P>How do I find the time difference (epoch time is fine too) between two _time values in two difference log files ?</P> Mon, 21 Jan 2013 17:27:22 GMT https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93908#M19533 asarolkar 2013-01-21T17:27:22Z https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93909#M19534 <P>Although it might not be the fastest, you can use "transaction".</P> <P><CODE>sourcetype="alphalog" OR sourcetype="betalog" | transaction accountId maxspan=10m| timechart duration by accountId</CODE></P> <P>Transaction calculates the duration in seconds for each transaction.</P> <P>You can also do a stats and eval:</P> <P><CODE>sourcetype="alphalog" OR sourcetype="betalog" | stats latest(_time) as lt earliest(_time) as et by accountId| eval duration = lt - et| table duration accountID</CODE></P> Mon, 21 Jan 2013 17:46:09 GMT https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93909#M19534 alacercogitatus 2013-01-21T17:46:09Z https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93910#M19535 <P>Hi,</P> <P>I have a stupid question for followup <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> !</P> <P>What if the field was named accountNumber in alphalog and accountId in betalog, how would the searches that you suggested change (obviously a join is involved)</P> Mon, 21 Jan 2013 18:31:54 GMT https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93910#M19535 asarolkar 2013-01-21T18:31:54Z https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93911#M19536 <P>It's all in manuals <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Let's say you have a set of events where the IP address is extracted to either clientip or ipaddress. This example defines a new field called ip, that takes the value of either clientip or ipaddress, depending on which is not NULL (exists in that event):</P> <P><CODE>... | eval ip=coalesce(clientip,ipaddress)</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Mon, 21 Jan 2013 19:23:27 GMT https://community.splunk.com/t5/Getting-Data-In/Calculating-time-difference-between-two-fields-of-the-same-name/m-p/93911#M19536 kallu 2013-01-21T19:23:27Z