topic Re: Strftime and adding leading zeros to time difference in Getting Data In

Strftime and adding leading zeros to time difference

timm7474 — Mon, 14 Jun 2021 21:31:13 GMT

Hi, I have a field called time_diff that I've eval'd from two other fields to calculate the difference in time between those fields. The calculation is working fine and when I strftime the time_diff back to human readable, I'm using

eval time_diff_final=strftime(time_diff, "%H:%M:%S.%3Q")

When I display the result of time_diff I see

0.13400

However when I look at the result of time_diff_final I see this.

19:00:00.134

The milliseconds is the correct calculation, but for some reason instead of putting a zero in the %H field I'm getting 19 for every single result.

Any ideas?

Thanks!

Re: Strftime and adding leading zeros to time difference

venkatasri — Mon, 14 Jun 2021 23:43:33 GMT

Hi @timm7474

How did you calculate time_diff can you share the samples of it?

Re: Strftime and adding leading zeros to time difference

timm7474 — Mon, 14 Jun 2021 23:48:54 GMT

Sure, here is that part of the SPL.

| eval new_attimestamp=strptime('@timestamp',"%Y-%m-%dT%H:%M:%S.%3Q")
| eval new_mdctime=strptime('mdc.time',"%Y-%m-%dT%H:%M:%S.%3Q")
| eval time_diff=(new_attimestamp-new_mdctime)
| eval time_diff_final=strftime(time_diff,"%H:%M:%S.%3")

Re: Strftime and adding leading zeros to time difference

venkatasri — Tue, 15 Jun 2021 00:06:56 GMT

@timm7474

Can you share few samples of time_diff?

Re: Strftime and adding leading zeros to time difference

timm7474 — Tue, 15 Jun 2021 00:12:42 GMT

0.114000

0.011000

and time_diff_final looks like this for the above values. And you can see the 19 added when I add hour %H.

19:00:00.114

19:00:00.011

Re: Strftime and adding leading zeros to time difference

venkatasri — Tue, 15 Jun 2021 00:27:11 GMT

@timm7474

You are actually getting duration in seconds as outcome not epoc, strftime function accepts epoc and returns as per format. your time_diff is difference in seconds.

-----

An upvote would be appreciated if it helps!

Re: Strftime and adding leading zeros to time difference

timm7474 — Tue, 15 Jun 2021 01:22:24 GMT

I just ran a test and did this to see how formatting would be for a day or more time difference.

| eval time_diff=(1623704985-new_mdctime). (the # is June 14, 2021 9:09:45 PM)

against this date:

2021-06-11T21:48:28.254Z

Which has a strptime of1623462508.254000

I get a difference of:

242476.746000

Any idea how to get it formatted properly so it shows hours, minutes, seconds and milliseconds?

Thanks!

Re: Strftime and adding leading zeros to time difference

venkatasri — Tue, 15 Jun 2021 02:54:23 GMT

Hi @timm7474

This might work but need through testing, a good way to start!

Output TIME_DIFF = 67:21:16.746 , h:m:s.3Q format

---

An upvote would be appreciated if it helps!