topic Re: Trying to create and populate a ProcessingTime field from 2 time fileds in Splunk Search

Trying to create and populate a ProcessingTime field from 2 time fileds

kesrich — Mon, 19 Apr 2021 18:55:49 GMT

I have a log that that has multiple utc times listed. The logs are ingested into Splunk and I have created a field extraction to show those times in my Splunk table query. Now I am trying to populate the ProcessingTime with the difference between two of the fields. I'm missing something. Can't get the ProcessingTime to populate. Any help would be great.

Query:
host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=file_modified-file_created
| table ProcessingTime, file_modified, file_created, corp_copy_dt

Sample Result:

ProcessingTime file_modified file_created corp_copy_dt

+2021-04-19T18:15:19:564+00:00-UTC

+2021-04-19T18:15:19:299+00:00-UTC

+2021-04-19T15:15:19:000+00:00-UTC

+2021-04-19T18:15:18:955+00:00-UTC

+2021-04-19T18:15:18:689+00:00-UTC

+2021-04-19T15:15:19:000+00:00-UTC

+2021-04-19T18:15:20:470+00:00-UTC

+2021-04-19T18:15:19:924+00:00-UTC

+2021-04-19T15:15:20:000+00:00-UTC

+2021-04-19T18:15:21:205+00:00-UTC

+2021-04-19T18:15:20:861+00:00-UTC

+2021-04-19T15:15:21:000+00:00-UTC

Re: Trying to create and populate a ProcessingTime field from 2 time fileds

manjunathmeti — Mon, 19 Apr 2021 19:19:10 GMT

hi @kesrich,
You need to convert date time to epoch time and then calculate the difference. Below query gives ProcessingTime in hours.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log" | eval ProcessingTime=round((strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"))/3600, 2) | table ProcessingTime, file_modified, file_created, corp_copy_dt

If this reply helps you, a like would be appreciated.

Re: Trying to create and populate a ProcessingTime field from 2 time fileds

kesrich — Mon, 19 Apr 2021 20:08:14 GMT

@manjunathmeti
This looks like a great start, but can we remove the "round" option? And is there a way to format the display of the ProcessingTime? I need the milliseconds of this. Thanks for the quick reply!!

Re: Trying to create and populate a ProcessingTime field from 2 time fileds

manjunathmeti — Tue, 20 Apr 2021 06:40:27 GMT

Yes, you can, using tostring function.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log" | eval ProcessingTime=tostring(strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"), "duration") | table ProcessingTime, file_modified, file_created, corp_copy_dt

If this reply helps you, a like would be appreciated.