topic Re: Strftime adds 1 hour after converting in Splunk Search

Strftime adds 1 hour after converting

MedralaG — Mon, 16 Apr 2018 14:34:26 GMT

I'm working on identifying which hosts are located in which time zone as the client does not have an inventory list and they have devices all around the globe.
I'm calculating the difference between the _time that was extracted from the log and _indextime to establish the difference between them, which will be a good indication of how many time zones the devices is away.
I get values of ranges around 0-15, around 3600 and around 7200, which is expected.
Now when I try to use strftime to express that difference into a readable format it always adds 1 hour to it.

Re: Strftime adds 1 hour after converting

damien_chillet — Mon, 16 Apr 2018 14:41:48 GMT

Don't use strftime to deal with durations, use the following (where diff is your difference value in seconds):

 | eval diff=tostring(diff, "duration")

Re: Strftime adds 1 hour after converting

MedralaG — Mon, 16 Apr 2018 15:59:20 GMT

Nice one, thank you.

Re: Strftime adds 1 hour after converting

damien_chillet — Mon, 16 Apr 2018 16:05:57 GMT

You welcome 🙂

Re: Strftime adds 1 hour after converting

pheonix101 — Thu, 14 Jun 2018 15:38:28 GMT

Hi damien_chillet, I managed to get a desired value by following your suggestion, but now I get a result as 09:11:00.000000 instead of 09:11:00

I am trying to calculate difference between 2 time ranges 3/27/2018 14:01 and 3/27/2018 23:12.

am I missing something?

Re: Strftime adds 1 hour after converting

pheonix101 — Thu, 14 Jun 2018 15:42:12 GMT

Hi damien_chillet,

i managed to get a desired result by following your suggestion,

I am trying to calculate difference between 2 time ranges 3/27/2018 14:01 and 3/27/2018 23:12, but I get a result as 09:11:00.000000 instead of 09:11:00

query:

index=myindex| eval submit=strptime(in, "%m/%d/%Y %H:%M") | eval response=strptime(out, "%m/%d/%Y %H:%M") | eval Total=response-submit | eval Ntotal=tostring(Total,"duration")

please advise.

Re: Strftime adds 1 hour after converting

MedralaG — Fri, 15 Jun 2018 08:11:44 GMT

whats is your string?

Re: Strftime adds 1 hour after converting

pheonix101 — Fri, 15 Jun 2018 08:34:39 GMT

time ranges 3/27/2018 14:01 and 3/27/2018 23:12

index=myindex| eval submit=strptime(in, "%m/%d/%Y %H:%M") | eval response=strptime(out, "%m/%d/%Y %H:%M") | eval Total=response-submit | eval Ntotal=tostring(Total,"duration")

Re: Strftime adds 1 hour after converting

MedralaG — Fri, 15 Jun 2018 08:47:12 GMT

hmm, interesting, without spending too much time looking into why it's giving you .0000 you can just do a round command on the Total eval to get rid of those , so:

| eval Total=round(response-submit,0)

Re: Strftime adds 1 hour after converting

pheonix101 — Fri, 15 Jun 2018 11:24:52 GMT

That did the trick. Thanks again 🙂

Re: Strftime adds 1 hour after converting

pheonix101 — Fri, 15 Jun 2018 11:31:02 GMT

I am still trying to learn more about splunk functionality, any suggestions on learning Splunk commands (video guides/reference materials) would be helpful.