topic Find Avg Diff two Date fields in Splunk Search

Find Avg Diff two Date fields

I-Man — Mon, 28 Sep 2020 13:27:17 GMT

Splunkers,

I have events from our Helpdesk ticketing system that have two date fields, DateOpen and DateClosed, both with the following format:
2013-02-25 12:50
2013-02-26 12:58

I am trying to write a report that shows average time from when the ticket was opened and when it was closed. Based on research, i think i need to convert these to epoch time using mktime and then do the subtraction, then convert back to ctime. Unfortunately, i cant get mktime to return any values.

convert timeformat="%y/%m/%d %H-%M" mktime(DateClosed) AS closedon_epoch | table DateClosed, closedon_epoch

Am i missing something here or am i going about this the wrong way? Thanks in advance for any help.

Re: Find Avg Diff two Date fields

jonuwz — Wed, 06 Mar 2013 16:32:17 GMT

strptime is the way i'd do it ...

... | eval open_epoch=strptime(DateOpen,"%Y-%m-%d %H:%M") 
    | eval close_epoch=strptime(DateClosed,"%Y-%m-%d %H:%M")
    | eval duration=tostring(close_epoch-open_epoch,"duration")
    | ...

Re: Find Avg Diff two Date fields

I-Man — Wed, 06 Mar 2013 22:06:28 GMT

Perfect, thanks!!!