topic Re: Find Latency in Days in Splunk Enterprise Security

Find Latency in Days

bmer — Fri, 14 Mar 2025 13:50:10 GMT

I have a splunk where one of the eval method as part of main splunk query is as below.Iam not sure why SnapshotTimestamp is divided by 1000 but I presume it could be done to convert it to seconds.Sorry am a newbie

| eval snapshot_processed = strftime(SnapshotTimestamp/1000, "%Y-%m-%d %H:%M:%S")

Iam trying to find the # of days clasped between "snapshot_processed" and today. I tried to modify the splunk as below and then try to view the table for "latencyInDays".However it does not return any value.

| eval nowstring=now() | eval latencyInDays=(nowstring-snapshot_processed)/86400

What am I missing?

Re: Find Latency in Days

isoutamo — Fri, 14 Mar 2025 14:06:49 GMT

Usually when you are using 1000 with divider and/or multiplier, there have done conversion between ms and s and vice versa.
86400 is 24h in seconds

It's hard to say more without seeing your data/values on those fields.

One way to see it is use

| eval latencyInDays = tostring(latencyInSeconds, "duration")

and if you want to just show it in screen but keep value still in seconds just replace eval with fieldformat.

r. Ismo

Re: Find Latency in Days

dural_yyz — Fri, 14 Mar 2025 14:03:28 GMT

| eval duration = tostring(diff, "duration")

This will output Days & Clock type output.

Re: Find Latency in Days

livehybrid — Fri, 14 Mar 2025 14:07:57 GMT

Hi @bmer

Is your SnapshotTimestamp in milliseconds? Im assuming so because you're dividing by 1000.

You should be able to do this:

| eval latencyInDays=floor((now()-(SnapshotTimestamp/1000)) / 86400)

Here is a full example to test with:

| makeresults | eval SnapshotTimestamp=1741788339000 | eval latencyInDays=floor((now()-(SnapshotTimestamp/1000)) / 86400)

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Find Latency in Days

richgalloway — Fri, 14 Mar 2025 14:10:51 GMT

The query is mixing strings (snapshot_processed) with integers (nowstring), which Splunk cannot do. Try this

| eval latencyInDays=(now() - SnapshotTimestamp/1000)/86400