topic Re: Issue with doing math on event times? in Splunk Search

Issue with doing math on event times?

msarro — Tue, 25 Jan 2011 05:09:05 GMT

Here is my current code:

index="sandbox" sourcetype="AS-CDR" | where Called_Number="2155551060" OR
       Calling_Number="2155551060" OR
       Called_Number="12155551060" OR
       Calling_Number="12155551060" OR
       Called_Number="+12155551060" OR
       Calling_Number="+12155551060" |eval timeToAnswer=(strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q"))

When I attempt to perform that operation, it doesn't give me any value for timeToAnswer, even though the operator is supposed to create a new column that can be used. I know it works because I can take an average using avg(timeToAnswer) and get a result. But if I try to append

|fields Start_Time Answer_Time timeToAnswer

It doesn't show. Can anyone explain how to fix this? The timestamps are in the following format:

20110119212921.053

Re: Issue with doing math on event times?

Paolo_Prigione — Tue, 25 Jan 2011 21:29:26 GMT

If you select the timeToAnswer field from the field picker, does it show its top 10 values?

"fields" is not used to display a field under the raw text of the events. You can use the field picker on the left to "always show" the field timeToAnswer or the

... | table Start_Time Answer_Time timeToAnswer

command to display tabular results. Let us know if it worked!

Re: Issue with doing math on event times?

msarro — Wed, 26 Jan 2011 23:55:30 GMT

Thanks! Reading through the manual is a pretty good exercise, I should try it more often 😉

Re: Issue with doing math on event times?

Paolo_Prigione — Thu, 27 Jan 2011 00:40:36 GMT

We are all very lucky that Splunk's manual is really well done 😄