topic Time coversion not working in Splunk Search

Time coversion not working

nwoolley — Wed, 30 Sep 2020 02:37:20 GMT

index=asg Process_name=WLR_22-15_Rating earliest =-5m | convert timeformat="%d-%M-%Y-%H:%M:%S" mktime(start_dtm) mktime(end_dtm) | eval duration=end_time-start_time | table duration

Data
15-OCT-2019-11:25:02,Process_name=WLR_22-15_Rating,start_dtm=14-OCT-2019-22:15:40,end_dtm=15-OCT-2019-00:47:36,errors=10503,work_done=651649

Not sure why the above is failing any help would be grateful thanks

Re: Time coversion not working

kamlesh_vaghela — Tue, 15 Oct 2019 10:37:13 GMT

@nwoolley

Can you please try this?

index=asg Process_name=WLR_22-15_Rating earliest =-5m 
| eval start_time=strptime(start_dtm,"%d-%b-%Y-%H:%M:%S"), end_time=strptime(end_dtm,"%d-%b-%Y-%H:%M:%S") 
| eval duration=end_time-start_time 
| table duration

Example:

| makeresults 
| eval _raw="15-OCT-2019-11:25:02,Process_name=WLR_22-15_Rating,start_dtm=14-OCT-2019-22:15:40,end_dtm=15-OCT-2019-00:47:36,errors=10503,work_done=651649" 
| extract 
| eval start_time=strptime(start_dtm,"%d-%b-%Y-%H:%M:%S"), end_time=strptime(end_dtm,"%d-%b-%Y-%H:%M:%S") | eval duration=end_time-start_time | table duration

Re: Time coversion not working

nwoolley — Tue, 15 Oct 2019 10:44:54 GMT

Perfect answer very quick thank you

Re: Time coversion not working

nwoolley — Tue, 15 Oct 2019 10:45:09 GMT

Perfect answer very quick thank you

Re: Time coversion not working

kamlesh_vaghela — Tue, 15 Oct 2019 10:53:18 GMT

Great @nwoolley

Please upvote and accept this answer to close this question.