https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192064#M187216 <P>Hi,</P> <P>i have multiple events for each order and i want to subtract start and end events for each order. So i have created a filed called "action" and which gives whether it is a start or end event. So the value for "action" field would be start or end. i have converted time to numeral number but i am not sure how to get times for start and end and then subtract for each order to calculate the latency. i have used the query below. but not sure how to move forward. Any suggestions please. </P> <P>| convert mktime(_time) as T1 | eval Type=if(action=start,"start","end") | stats values(T1) as Time by Type, Order | eval Latency = ("Time: start" - "Time: end") | </P> Fri, 22 Aug 2014 16:17:31 GMT xvxt006 2014-08-22T16:17:31Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192064#M187216 <P>Hi,</P> <P>i have multiple events for each order and i want to subtract start and end events for each order. So i have created a filed called "action" and which gives whether it is a start or end event. So the value for "action" field would be start or end. i have converted time to numeral number but i am not sure how to get times for start and end and then subtract for each order to calculate the latency. i have used the query below. but not sure how to move forward. Any suggestions please. </P> <P>| convert mktime(_time) as T1 | eval Type=if(action=start,"start","end") | stats values(T1) as Time by Type, Order | eval Latency = ("Time: start" - "Time: end") | </P> Fri, 22 Aug 2014 16:17:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192064#M187216 xvxt006 2014-08-22T16:17:31Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192065#M187217 <P>_time is already in epoch format right? why do you need to convert?</P> Fri, 22 Aug 2014 17:14:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192065#M187217 strive 2014-08-22T17:14:31Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192066#M187218 <P>Since start occurs first and end in the last, can you try this simple approach...<BR /> Your search... | stats max(_time) as End, min(_time) as Start by OMSOrder | eval Latency = End - Start</P> Mon, 28 Sep 2020 17:23:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192066#M187218 strive 2020-09-28T17:23:25Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192067#M187219 <P>Try this (assuming the value of the field Type is either 'start' or 'end')</P> <PRE><CODE>your base search | chart first(_time) over action by OMSOrder | eval latency=end-start </CODE></PRE> Fri, 22 Aug 2014 17:40:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192067#M187219 somesoni2 2014-08-22T17:40:07Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192068#M187220 <P>Awesome..Simple is better</P> Fri, 22 Aug 2014 20:01:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192068#M187220 xvxt006 2014-08-22T20:01:40Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192069#M187221 <P>One question is, i get the latency and when i use strftime i am getting the actual time but not the duration in secs or millli seconds. is there any function for that</P> Fri, 22 Aug 2014 20:29:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192069#M187221 xvxt006 2014-08-22T20:29:58Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192070#M187222 <P>The latency calculated here will be seconds already (as end and start are epoch time). You want to format the latency value to any specify format? If you want to format it as duration, your can use this in the search.</P> <P>after chart command | eval latency=tostring(end-start,"duration")</P> Fri, 22 Aug 2014 20:37:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192070#M187222 somesoni2 2014-08-22T20:37:18Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192071#M187223 <P>i got it. i have used | convert dur2sec(Latency)</P> Fri, 22 Aug 2014 20:42:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-times-for-different-events/m-p/192071#M187223 xvxt006 2014-08-22T20:42:44Z