Time format & Duration Calc

zoebanning — Wed, 13 Oct 2021 02:52:21 GMT

Hello Splunk Community,

Can anyone help me build a query based on the below;

I want to convert a field (Fri Oct 8 23:15:05 AEDT 2021) into time format & then calculate the duration by subtracting the end time by the start time.

Appreciate your help 🙂

Re: Time format & Duration Calc

kamlesh_vaghela — Wed, 13 Oct 2021 05:00:54 GMT

@zoebanning

You can achieve this by using strptime function and tostring function.

Can you please try this?

YOUR_SEARCH |eval start_epoch=strptime(start_time,"%a %b %d %H:%M:%S %Z %Y"),end_epoch=strptime(end_time,"%a %b %d %H:%M:%S %Z %Y"), diff_in_sec=end_epoch-start_epoch,duration=tostring(diff_in_sec,"duration")

My Sample Search :

| makeresults | eval start_time="Fri Oct 8 23:15:05 AEDT 2021",end_time="Fri Oct 8 23:20:05 AEDT 2021" |eval start_epoch=strptime(start_time,"%a %b %d %H:%M:%S %Z %Y"),end_epoch=strptime(end_time,"%a %b %d %H:%M:%S %Z %Y"), diff_in_sec=end_epoch-start_epoch,duration=tostring(diff_in_sec,"duration")

References:

Conversion functions

Date and Time functions

Date and time format variables

I hope this will help you.

Thanks
KV
▄︻̷̿┻̿═━一 😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Time format & Duration Calc

zoebanning — Wed, 13 Oct 2021 05:30:26 GMT

Thank you Karma! This was exactly what I needed, appreciate your help 😀

topic Re: Time format & Duration Calc in Splunk Search

Time format & Duration Calc

Re: Time format & Duration Calc

Re: Time format & Duration Calc