topic Re: Calcualte Duration in Splunk Search

How to calculate duration?

edwinmae — Mon, 06 Jun 2022 03:12:41 GMT

Hi,

I try to calculate the duration

I have extracted 2 fields, start_time and end_time

I believe both times should be in the exact same format in order to successful calculate the duration

start_time = 2022-06-03T02_11_50

end_time = 2022-06-03T03:48:06

I have been puzzling for some time now, but how do I get the start_time in the same format as the end_time? ...

Thanks for help in advance!

Edwin

ITWhisperer — Fri, 03 Jun 2022 12:19:23 GMT

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S") | eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")

edwinmae — Fri, 03 Jun 2022 12:24:28 GMT

That actually worked 🙂