topic Re: Difference between two times in Splunk Search

Difference between two times

mbasharat — Wed, 30 Sep 2020 04:40:10 GMT

Hi,

I have two fields in my report. Time_Created and Time_Closed. They are for time an incident ticket was created and then closed.

Their format is:

Time_Created: 12/20/19 11:30
Time_Closed: 1/1/20 16:50

I need to find the difference between both and result in an additional field e.g. Time_to_resolution.

Basically, I need to see how long it took to resolve a ticket from its creation to closure.

Thanks, in advance!!!

Re: Difference between two times

vnravikumar — Fri, 20 Mar 2020 05:42:42 GMT

Check this

| makeresults 
| eval Time_Created="12/31/19 11:30",Time_Closed="1/1/20 16:50" 
| eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y %H:%M") -strptime(Time_Created,"%m/%d/%y %H:%M"),0),"duration") 
| eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") |table Time_Created Time_Closed Time_to_resolution

Re: Difference between two times

mbasharat — Wed, 30 Sep 2020 04:40:11 GMT

Many thanks for promptness. And how about if it is just date only?

Time_Created: 12/20/19
Time_Closed: 1/1/20

To how many days it took.

Re: Difference between two times

vnravikumar — Fri, 20 Mar 2020 06:43:51 GMT

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y") -strptime(Time_Created,"%m/%d/%y"),0),"duration") 
 | eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 day(s)")

Re: Difference between two times

mbasharat — Fri, 20 Mar 2020 06:54:27 GMT

This is awesome! TY!!! This triggered my curiosity for some additional chart for my use case. How about converting below to month? Either fields with or without time will work because I am using everything you have provided.

Time_Created: 12/20/19 11:30 to MonthCreated=December

Time_Closed: 1/1/20 16:50 to MonthClosed=January

Case statement or whatever is best as you suggest?

Re: Difference between two times

vnravikumar — Fri, 20 Mar 2020 07:13:04 GMT

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval MonthCreated = strftime(strptime(Time_Created,"%m/%d/%y"),"%B"), MonthClosed=strftime(strptime(Time_Closed,"%m/%d/%y"),"%B")

Re: Difference between two times

mbasharat — Fri, 20 Mar 2020 14:49:07 GMT

Awesome!!! THANK YOU!!!