topic subtracting 2 timestamps and then evaluating if that result is longer than 1 hour in Splunk Search

subtracting 2 timestamps and then evaluating if that result is longer than 1 hour

samnew4598 — Tue, 06 Jul 2021 21:16:07 GMT

I have two timestamps that are in this format within my log events:

start: 2005-07-05T04:28:34.453494Z

end: 2005-07-05T05:28:39.462681Z

I would like to subtract the timestamps then evaluate them to see if the result is greater or equal to 1 hour and include that event in my query results

Extra:

if so how long?

Re: subtracting 2 timestamps and then evaluating if that result is longer than 1 hour

ITWhisperer — Tue, 06 Jul 2021 22:23:24 GMT

| rex "start: (?<start>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)" | rex "end: (?<end>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)" | eval start=strptime(start,"%Y-%m-%dT%H:%M:%S.%6QZ") | eval end=strptime(end,"%Y-%m-%dT%H:%M:%S.%6QZ") | eval diff=end-start | where diff>=(60*60) | fieldformat diff=tostring(diff,"duration")

Re: subtracting 2 timestamps and then evaluating if that result is longer than 1 hour

samnew4598 — Wed, 07 Jul 2021 14:53:32 GMT

This works great! If you have time can you explain it a bit, I don't know why we need to use "rex" to extract the time? I get the rest of the query as that was one of my initial tries but without the rex. Thanks!