https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314532#M162700 <P>I have never created a field in Splunk, I know how to create an event type, a field seems little different to me.</P> Sun, 04 Mar 2018 23:24:05 GMT murat89 2018-03-04T23:24:05Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314527#M162695 <P>Hi guys, </P> <P>im a beginner in Splunk and my issue is that I have Cisco logs and I need to find out the conference duration but there is no field like duration so I have to make it through timestamps. <BR /> Below you can see that kind of log and I don't know how to get the timestamps and then calculate the difference between them, please help, im thankful for any idea. </P> <P>Just a part of Cisco log:<BR /> 2814 2018/01/22 09:56:39.008 APP Info conference "Terminal 1" created<BR /> 2846 2018/01/22 12:01:30.213 APP Info conference "Terminal 1": deleted via API (no participants)</P> Tue, 27 Feb 2018 20:18:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314527#M162695 murat89 2018-02-27T20:18:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314528#M162696 <P>Best (in terms of performance) is to use stats on a field (or group of fields), preferably a primary key which is common between both type of events (conference start and end) and can uniquely identify the conference. For example, if there is field call conference_id in your logs, you can do something like this</P> <PRE><CODE>index=YourIndex sourcetype=YourCiscoSourcetype (conference created) OR (conference deleted) | eval confStart=if(searchmatch("conference created"),"_time,null()) | eval confEnd=if(searchmatch("conference deleted"),"_time,null()) | stats values(confStart) as confStart values(confEnd) as confEnd by conference_id | eval "duration(in secs)"=confEnd-confStart </CODE></PRE> Tue, 27 Feb 2018 20:46:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314528#M162696 somesoni2 2018-02-27T20:46:51Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314529#M162697 <P>Thank you, great solution, i really appreciate that. Unfortunately there is no conference_id but we do have the conference name, here it is "Terminal 1". How to do with that? </P> Wed, 28 Feb 2018 10:43:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314529#M162697 murat89 2018-02-28T10:43:45Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314530#M162698 <P>Extract the data where the name is to a field called conference_name and change out the by conference_id.</P> Tue, 29 Sep 2020 18:17:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314530#M162698 starcher 2020-09-29T18:17:50Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314531#M162699 <P>@murat89, based on the sample data provided please try the following run anywhere search.</P> <P>PS: First 5 pipes from <CODE>makeresults</CODE> to <CODE>rename</CODE> are used to generate the mock data. Also while I have extracted <CODE>_time</CODE> using rex, you might need the rex command from <CODE>APP Info conference</CODE> onward as your data will have timestamp extracted already.</P> <PRE><CODE>| makeresults | eval data="2814 2018/01/22 09:56:39.008 APP Info conference \"Terminal 1\" created;2846 2018/01/22 12:01:30.213 APP Info conference \"Terminal 1\": deleted via API (no participants)" | makemv data delim=";" | mvexpand data | rename data as _raw | rex "\d{4}\s(?&lt;_time&gt;\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})\sAPP Info conference\s\"(?&lt;id&gt;[^\"]+)\"(\s|\:)+(?&lt;status&gt;\w+)" | eval _time=strptime(_time,"%Y/%m/%d %H:%M:%S.%3N") | stats first(_time) as _time last(_time) as EndTime values(status) as status by id | search status=created AND status=deleted | eval duration=EndTime-_time | fields - EndTime </CODE></PRE> Sun, 04 Mar 2018 18:49:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314531#M162699 niketn 2018-03-04T18:49:25Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314532#M162700 <P>I have never created a field in Splunk, I know how to create an event type, a field seems little different to me.</P> Sun, 04 Mar 2018 23:24:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-timestamps-to-get/m-p/314532#M162700 murat89 2018-03-04T23:24:05Z