https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24215#M177501 <P>What do you mean by "calculating" hours?</P> Thu, 02 Aug 2012 17:01:04 GMT Ayn 2012-08-02T17:01:04Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24214#M177500 <P>I am trying to build a working hours report with splunk...</P> <P>I have a start date and an end date like so:</P> <P>start_time<BR /> 2012-07-03 12:56:07</P> <P>end_time<BR /> 2012-07-14 16:30:22</P> <P>calculating calendar hours is simple but how do i get working hours?</P> <P>any ideas?</P> Thu, 02 Aug 2012 15:00:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24214#M177500 kenchisho 2012-08-02T15:00:18Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24215#M177501 <P>What do you mean by "calculating" hours?</P> Thu, 02 Aug 2012 17:01:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24215#M177501 Ayn 2012-08-02T17:01:04Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24216#M177502 <P>well the number of working hours between the start_time and end_time</P> <P>for example i start working on a task at 09:00 AM on monday and finish at 13:00 PM on wednesday... i wish to count the number of working hours on the task...</P> Mon, 28 Sep 2020 12:11:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24216#M177502 kenchisho 2020-09-28T12:11:45Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24217#M177503 <P>you can convert your time to epochtime, ft not already done or use the splunk timestamp (in _time as epoch time)<BR /> if you want other time calculations, use eval.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Convert" target="_blank">http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Convert</A></P> <PRE> mysearch_for_my_task | convert timeformat="%Y-%M-%d %H:%M:%S" start_second=mktime(start_time) AS start_second | convert timeformat="%Y-%M-%d %H:%M:%S" start_second=mktime(end_time) AS end_second | eval duration_second=end_second-start_second | eval duration_hour=round(duration_second/360,0) | table duration_hour </PRE> <P>if the timestamp is the timestamp of the event, you can try a transaction<BR /> <PRE><BR /> mysearch | transaction mycommonfield startswith="keyword1" endswith="keyword2" <BR /> | table mycommonfield _time duration<BR /> </PRE><BR /> or use stats<BR /> <PRE><BR /> mysearch | stats first(_time) AS recent last(_time) AS oldest by mycommonfield <BR /> | eval duration_second=recent-oldest <BR /> | eval duration_second=end_second-start_second<BR /> | eval duration_hour=round(duration_second/360,0)<BR /> | table mycommonfield duration_hour<BR /> </PRE></P> Mon, 28 Sep 2020 12:11:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-working-hours-between-start-and-end-DateTime/m-p/24217#M177503 yannK 2020-09-28T12:11:58Z