topic Re: Subtract static value from list in Getting Data In

Subtract static value from list

dheri — Wed, 30 Sep 2020 00:57:34 GMT

I am trying to get time difference between 2 timestamps, I have one field deployment_ts with one value and list of time stamps commit_ts, i want a list containing the difference for each value in list with the other field eval commit_to_rel = (deployment_ts - commit_ts). Bu t I am not getting any result.

here is my query



index=x application_name="yy-xx-zz" event_type="ev"

| spath path=commits{}.date output=commit_date 

| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%z"))

| eval commit_ts = (strptime(commit_date, "%Y-%m-%dT%H:%M:%SZ"))

| eval commit_to_rel =  (deployment_ts - commit_ts)

| stats list(commit_date), list(commit_ts), list(deployment_ts), list(commit_to_rel)

Can anyone please tell me how to get this done?

here is the picture of results along with the querry.

Re: Subtract static value from list

kamlesh_vaghela — Wed, 19 Jun 2019 07:30:32 GMT

@dheri

Is the date format for deployment_time and commit_date are the same? If not, can you please share it else pls try below search?

| makeresults 
| eval _raw="{\"deployment_time\": \"2019-06-03T15:41:26Z\",\"commit_date\": \"2019-06-03T15:41:26Z\"}" 
| kv 
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z")) 
| eval commit_ts = (strptime(commit_date, "%Y-%m-%dT%H:%M:%SZ")) 
| eval commit_to_rel = (deployment_ts - commit_ts)

Just made change in | eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z"))

Re: Subtract static value from list

DavidHourani — Wed, 19 Jun 2019 10:00:18 GMT

Hi @dheri,

Try this :

index=x application_name="yy-xx-zz" event_type="ev"
| spath path=commits{}.date output=commit_date 
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z"))
| eval commit_ts = (strptime(commit_ts, "%Y-%m-%dT%H:%M:%SZ"))
| mvexpand commit_ts
| eval commit_to_rel =  (deployment_ts - commit_ts)

Let me know if that helps.

Cheers,
David

Re: Subtract static value from list

dheri — Wed, 30 Sep 2020 01:00:47 GMT

@kamlesh_vaghela
Yes, there is difference between date format of deployment_time and commit_date but they both are converted into unix timestamps, which I can see in result as deployment_ts and commit_ts. I tried the query you asked me. Here are the results

Re: Subtract static value from list

DavidHourani — Wed, 19 Jun 2019 15:11:50 GMT

Hi @dheri Was that helpful ? Can you let me know if it worked for you ?

Re: Subtract static value from list

dheri — Wed, 19 Jun 2019 15:13:47 GMT

Yes, I was able to expand single event into multiple events.

Re: Subtract static value from list

DavidHourani — Wed, 19 Jun 2019 15:14:48 GMT

Awesome ! Great to hear that !