<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: on list of _time values how to get start and end times by specific date in splunk in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541506#M153317</link>
    <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval date=strftime(_time,"%Y-%m-%d")
| stats earliest(_time) as start_time latest(_time) as end_time by date
| eval difference=(end_time-start_time)/60&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 26 Feb 2021 12:34:11 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-02-26T12:34:11Z</dc:date>
    <item>
      <title>on list of _time values how to get start and end times by specific date in splunk</title>
      <link>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541502#M153316</link>
      <description>&lt;P&gt;my search query returns list of _time values for multiple dates and below is start and end times for a each date&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2021-02-23 12:27:13.173&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2021-02-23 16:18:20.129&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2021-02-24 09:18:06.191&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2021-02-24 13:22:48.285&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2021-02-25 09:02:38.042&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2021-02-25 13:04:52.313&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;in the above list i need to display like below. i have tried multiple ways but unable to get the output in below format. is there any i can extract like below&lt;/SPAN&gt;&lt;/P&gt;&lt;TABLE width="389"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="68"&gt;Date&lt;/TD&gt;&lt;TD width="89"&gt;Start_time&lt;/TD&gt;&lt;TD width="89"&gt;End_time&lt;/TD&gt;&lt;TD width="143"&gt;difference in minutes&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;2/23/2021&lt;/TD&gt;&lt;TD&gt;2/23/21 12:27&lt;/TD&gt;&lt;TD&gt;2/23/21 16:18&lt;/TD&gt;&lt;TD&gt;231.11593&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 26 Feb 2021 11:57:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541502#M153316</guid>
      <dc:creator>Sivakesava574</dc:creator>
      <dc:date>2021-02-26T11:57:18Z</dc:date>
    </item>
    <item>
      <title>Re: on list of _time values how to get start and end times by specific date in splunk</title>
      <link>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541506#M153317</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval date=strftime(_time,"%Y-%m-%d")
| stats earliest(_time) as start_time latest(_time) as end_time by date
| eval difference=(end_time-start_time)/60&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 26 Feb 2021 12:34:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541506#M153317</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-02-26T12:34:11Z</dc:date>
    </item>
    <item>
      <title>Re: on list of _time values how to get start and end times by specific date in splunk</title>
      <link>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541538#M153328</link>
      <description>&lt;P&gt;This is resulting the data exactly what i intended&lt;/P&gt;</description>
      <pubDate>Fri, 26 Feb 2021 16:00:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/on-list-of-time-values-how-to-get-start-and-end-times-by/m-p/541538#M153328</guid>
      <dc:creator>Sivakesava574</dc:creator>
      <dc:date>2021-02-26T16:00:23Z</dc:date>
    </item>
  </channel>
</rss>

