https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551188#M156414 <P>So what I have now from my search so far</P><P>Product&nbsp; &nbsp; &nbsp;Status&nbsp; &nbsp; Time</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Start&nbsp; &nbsp; &nbsp; &nbsp; 8.00 AM</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.05 AM</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.15 AM</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; End&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.20 AM</P><P>Is there anyway I can get the duration (End - Start) = 20 minutes and then display as Duration for Product A as 20 minutes?</P> Tue, 11 May 2021 07:18:16 GMT moinyuso96 2021-05-11T07:18:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551188#M156414 <P>So what I have now from my search so far</P><P>Product&nbsp; &nbsp; &nbsp;Status&nbsp; &nbsp; Time</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Start&nbsp; &nbsp; &nbsp; &nbsp; 8.00 AM</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.05 AM</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.15 AM</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; End&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.20 AM</P><P>Is there anyway I can get the duration (End - Start) = 20 minutes and then display as Duration for Product A as 20 minutes?</P> Tue, 11 May 2021 07:18:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551188#M156414 moinyuso96 2021-05-11T07:18:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551197#M156415 <P>Try this run anywhere example</P><LI-CODE lang="markup">|makeresults |eval product="A"|eval status="Start A1 A2 End"|makemv status|mvexpand status |appendcols [|makeresults|eval time="08:00 08:05 08:15 08:20"|makemv time|mvexpand time ] |rename COMMENT as "Dummy data ends here" |eval time=strptime(time,"%H:%M") |stats max(eval(if(status=="Start",time,null()))) as Start_Time,max(eval(if(status=="End",time,null()))) as End_Time by product |eval duration=round((End_Time-Start_Time)/60)</LI-CODE><P>change stats to eventstats if you want to see all records in the result</P> Tue, 11 May 2021 08:21:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551197#M156415 renjith_nair 2021-05-11T08:21:02Z https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551200#M156416 <P>Thanks, it worked for me</P> Tue, 11 May 2021 08:37:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-duration-for-the-product-A-only-for-start-and-end/m-p/551200#M156416 moinyuso96 2021-05-11T08:37:32Z