topic Re: Calculating the duration in Splunk Search

Calculating the duration

joe06031990 — Mon, 24 Jan 2022 14:49:07 GMT

Hi,

I am trying to calculate the duration of a call from the bellow search however it is appearing blank, the format is 01/01/2015 13:26:29.64321574:

Any help would be greatly appreciated.

Thanks

Re: Calculating the duration

gcusello — Mon, 24 Jan 2022 14:55:19 GMT

Hi @joe06031990,

You are using a wrong conversion format in strptime, please try this:

index=test sourcetype=test | eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N") | eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N") | eval diff=tostring(last_time-created,"duration") | table diff

Then, probably, it's better to use the tostring option to display duration.

Ciao.

Giuseppe

Re: Calculating the duration

rrovers — Mon, 24 Jan 2022 14:55:35 GMT

01/01/2015 13:26:29.64321574 is not conform "%Y-%m-%dT%H:%M:%S.%3N" I assume

Re: Calculating the duration

joe06031990 — Mon, 24 Jan 2022 15:05:38 GMT

Hi,

Just tried however it is still showing as blank for

created

last_time

diff

index=test sourcetype=test| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff

Re: Calculating the duration

rrovers — Mon, 24 Jan 2022 15:46:18 GMT

I think you should use "/" instead of "-" between day,month,year.

Your example " 01/01/2015 13:26:29.64321574:" expects something like "%d/%m/%Y %H:%M:%S.%8N")

Re: Calculating the duration

gcusello — Mon, 24 Jan 2022 16:08:52 GMT

Hi @joe06031990,

you have to use the same format of you time in the strptime function, if you have

02/01/2015 13:26:29.64321574

where 02 id day, 01 is month, 2015 is year, 13 is the hour, 26 is the minute, 29 is the second and 64321574 are 8 number after seconds,

you have to use %d/%m/%Y %H:%M:%S.%8N

In other words, you have to exactly use the same format, also in spaces and characters (as "/").

Ciao.

Giuseppe

Re: Calculating the duration

gcusello — Tue, 25 Jan 2022 07:12:01 GMT

Hi @joe06031990,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉