topic not getting the time difference in Splunk Search

not getting the time difference

pench2k19 — Tue, 29 Sep 2020 23:01:42 GMT

Hi splunkers,

i m trying to calculate the time differece in minutes between the two fields sla_time and FILE_ARRIVALTIME . It seems the correct query for me , but not getting the time difference value from the following query. Any of you can help?

query:
| inputlookup SLA.csv |table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD|eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d"))|eval sla_time=replace (sla_time,","," ") |table SOR_NAME sla_time |join type=outer SOR_NAME [search index=xxx|rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)"|rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") |fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] |eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M")| eval time_diff = tostring((FILE_ARRIVALTIME_epoch-sla_time_epoch), "duration") |table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME time_diff

Re: not getting the time difference

pench2k19 — Thu, 31 Jan 2019 08:44:22 GMT

@vnravikumar

Re: not getting the time difference

kamlesh_vaghela — Thu, 31 Jan 2019 13:31:54 GMT

@pench2k19

Can you please confirm below search will have data in all fields ( SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch) ??

| inputlookup SLA.csv 
| table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD 
| eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d")) 
| eval sla_time=replace (sla_time,","," ") 
| table SOR_NAME sla_time 
| join type=outer SOR_NAME 
    [ search index=xxx 
    | rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)" 
    | rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" 
    | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") 
    | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) 
    | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") 
    | fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] 
| eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M") 
| table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch

Thanks

Re: not getting the time difference

pench2k19 — Thu, 31 Jan 2019 14:05:01 GMT

yes it does have all the fields....

Re: not getting the time difference

kamlesh_vaghela — Thu, 31 Jan 2019 14:15:18 GMT

Can you please share sample results ( first 5 rec) ?