topic Re: How to search duration using two timestamps? in Getting Data In

How to search duration using two timestamps?

splunker9999 — Mon, 25 Apr 2016 14:22:12 GMT

Hi,

We need to find duration between timestamps and the format looks like below.

max_time=1461593558.000
min _time=1461593258.000

Used the search below to convert this to a proper time frame.

index=datapower   |stats avg(Time) as Average,Count 
| eval Average=round(Average,2) |where Average>50
| addinfo 
| eval SearchstartTime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S")
| eval SearchendTime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")

Tried finding difference like this by adding this to the end of the search:

| eval diff= tostring(SearchendTime - SearchstartTime,"duration")

but it is not retrieving any results.

Can you please help?

Re: How to search duration using two timestamps?

ccsfdave — Mon, 25 Apr 2016 14:31:23 GMT

I have a search to find VPN connection durations, which I built a long time ago and probably with the help of answers.splunk.com. But here are the relevant parts if you can pick it apart for your usecase:

 | convert dur2sec(duration) |bucket _time span=1d | stats sum(duration) as sumdur by _time src_ip  |eval "Time Connected"=tostring(sumdur, "duration") |fields - sumdur |rename _time as Date | convert timeformat=%m/%d/%Y ctime(Date)

Re: How to search duration using two timestamps?

somesoni2 — Tue, 29 Sep 2020 09:29:20 GMT

Use info_min_time and info_max_time (which are in epoch format) to calculate duration.

 index=datapower   |stats avg(Time) as Average,Count 
 | eval Average=round(Average,2) |where Average>50
 | addinfo | duration=(info_max_time-info_min_time,"duration")
 | eval SearchstartTime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S")
  |eval SearchendTime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")

Re: How to search duration using two timestamps?

splunker9999 — Mon, 25 Apr 2016 14:52:34 GMT

Thanks Dave, used tostring with eval, but this is not returning any results .There might be some issue with strftime .

Re: How to search duration using two timestamps?

ccsfdave — Mon, 25 Apr 2016 15:08:48 GMT

Hmm, sorry it's not working for you... I stripped it down more and the eval does work for me (obviously). Not sure why.

| convert dur2sec(duration) | stats sum(duration) as sumdur |eval "Time Connected"=tostring(sumdur, "duration")

duration is a field in my data. ignoring the bucket of one day tied to the _time (parses the search by date)...I just ran my new search for 24h which is the same thing (and much quicker). The above results in:

sumdur Time Connected
106846 1+05:40:46

Yeah...I live on VPN...

Re: How to search duration using two timestamps?

Richfez — Mon, 25 Apr 2016 19:16:27 GMT

Please confirm that

 index=datapower   |stats avg(Time) as Average,Count

returns events?