topic Re: Why is the time difference not evaluating correctly? in Getting Data In

Why is the time difference not evaluating correctly?

aohls — Mon, 24 Jun 2019 13:56:32 GMT

I am working to find the difference between two events and have the following:

| stats earliest(_time) as startTime, latest(_time) as endTime by JobName
| eval time=strftime(_time, "%H:%M:%S")
| eval runTime=(endTime-startTime)
| eval runTime=strftime(runTime,"%H:%M:%S")
| table JobName, runTime

I am getting back a runTime of 22:43:35, which is not what I expect or want. I would like the time to show starting from 0, I want the runTime to show in a format of 03:23:00; 3 hours and 23 minutes.

Re: Why is the time difference not evaluating correctly?

somesoni2 — Mon, 24 Jun 2019 14:04:01 GMT

Give this a try

| stats earliest(_time) as startTime, latest(_time) as endTime by JobName
| eval time=strftime(_time, "%H:%M:%S")
| eval runTime=(endTime-startTime)
| eval runTime=tostring(runTime,"duration")
| table JobName, runTime

Re: Why is the time difference not evaluating correctly?

aohls — Mon, 24 Jun 2019 14:07:35 GMT

@somesoni2 That worked perfect and exactly what I was looking for.

Re: Why is the time difference not evaluating correctly?

VatsalJagani — Mon, 24 Jun 2019 14:08:49 GMT

Yeah, tostring(runTime,"duration") should work.

Re: Why is the time difference not evaluating correctly?

aohls — Mon, 24 Jun 2019 14:15:51 GMT

Would this mean that I cannot use the runTime in a timechart? The runTime is the running of jobs and I was looking to show the daily runs to graph over time.

Re: Why is the time difference not evaluating correctly?

VatsalJagani — Mon, 24 Jun 2019 14:26:35 GMT

runTime was in seconds, after using tostring we have converted into string. You can use integer in timechart not string.
But I don't think timechart will fit here, you can use Timeline visualization.

Re: Why is the time difference not evaluating correctly?

FrankVl — Mon, 24 Jun 2019 14:30:49 GMT

runtime is just the number of seconds between start and end time. Not sure how you envisioned timecharting that 🙂
You might want to take a look at visualization add-ons that are perhaps more suitable for displaying job runtimes over time. e.g.: https://splunkbase.splunk.com/app/3120/

Also: not sure what that | eval time=strftime(_time, "%H:%M:%S") is doing there, as there is no _time field anymore after that stats command. But then again, you're not using that field anyway.

PS: you could also do | stats range(_time) as runTime by JobName| eval runTime=tostring(runTime,"duration") . But if you really want to visualize the job run on a timescale, you are probably going to need those start and end time values.

Re: Why is the time difference not evaluating correctly?

aohls — Mon, 24 Jun 2019 15:56:32 GMT

That makes sense. The idea was that these jobs run every day so I wanted to keep track of the run time to chart how long it is taking over time; really to trend the items over time.

Re: Why is the time difference not evaluating correctly?

sumanssah — Mon, 24 Jun 2019 16:33:06 GMT

Minor Revisions 😛

| stats earliest(_time) as startTime, latest(_time) as endTime by JobName
| eval runTime=(endTime-startTime)
| eval time=strftime(runTime, "%H:%M:%S")
| table JobName, time

Re: Why is the time difference not evaluating correctly?

FrankVl — Tue, 25 Jun 2019 07:06:51 GMT

You could of course just timechart the daily runtime value by assigning _time = startTime and then running a timechart with a span=1d. That doesn't visualize when the job started and stopped exactly (I thought that is what you were after), but does allow you to show a line/bar chart to show the runtime trend over time.

For example:

| stats earliest(_time) as startTime, latest(_time) as endTime by JobName
| eval _time=startTime
| eval runTime=(endTime-startTime)
| timechart span=1d avg(runTime) as runTime by jobName

Note: this charts the runtime as a number of seconds. If jobs typically take several minutes or hours to run, you might be better of displaying it as number of minutes. For example:

| stats earliest(_time) as startTime, latest(_time) as endTime by JobName
| eval _time=startTime
| eval runTime=round((endTime-startTime)/60,1)
| timechart span=1d avg(runTime) as runTime by jobName

Re: Why is the time difference not evaluating correctly?

woodcock — Mon, 01 Jul 2019 18:27:16 GMT

Try this:

... | stats range(_time) AS runTime BY JobName
| table JobName, runTime
| fieldformat runTime = tostring(runTime, "duration")