topic Re: Time without errors in Splunk Search

Time without errors

vgaltes — Fri, 27 Jan 2017 14:23:37 GMT

Hi,

I'm trying to calculate the time without errors in the system. To do that I'm doing something like

| eval now = now()
| convert timeformat="%Y-%m-%d %H:%M:%S.%3N" mktime(_time) AS epoch_time
| eval diff = now - epoch_time
| eval TimeWithoutErrors = strftime(diff,"%H:%M:%S")
| eval TimeNow = strftime(now,"%Y-%m-%d %H:%M:%S.%3N")
| eval EventTime = strftime(epoch_time,"%Y-%m-%d %H:%M:%S.%3N")
| head 1
| table TimeWithoutErrors, TimeNow, _time, EventTime

And the values I get are:

TimeNow: 2017-01-27 14:18:16.000 -> correct
_time: 2017-01-27 12:00:14.552 -> correct
EventTime: 2017-01-27 12:00:14.552 -> correct
TimeWithoutErrors: 03:18:01 -> not correct, should be one hour less

Why I'm getting an hour more that what I should get?

Thank you very much,
Vicenç

Re: Time without errors

somesoni2 — Fri, 27 Jan 2017 15:06:20 GMT

Try something like this. The _time field is already epoch so you don't need to convert it again.

your base search
| head 1
| eval TimeWithoutErrors = tostring(now()-_time,"duration")
| eval TimeNow= strftime(now(),"%Y-%m-%d %H:%M:%S.%3N")
| eval EventTime = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| table TimeWithoutErrors, TimeNow, _time, EventTime

Re: Time without errors

vgaltes — Fri, 27 Jan 2017 16:08:09 GMT

Works perfectly, thanks!