topic Re: Start time calculate for each transaction? in Splunk Search

How to start time calculation for each transaction?

xp001975 — Mon, 27 Feb 2023 23:12:32 GMT

Hi ,

I have a splunk log where we have End time and time to Serve Requst (in Millisec).
i want calculate Start time by subtracting End time - time to Serve Requst (in Millisec) . Can you please help me with the query which will help me to achieve this requirement.

Example:

End time -2023-02-27 10:46:13.559
time to server Request - 1131 (milliSec)

Re: Start time calculate for each transaction?

richgalloway — Mon, 27 Feb 2023 22:23:06 GMT

Is that one event or two? If two, then what field(s) connect them to a transaction?

Re: Start time calculate for each transaction?

bowesmana — Mon, 27 Feb 2023 22:41:40 GMT

Assuming those are your field names, here is an example

so just parse the time with strptime() and then subtract milliseconds /1000 from the end time to get start time

Re: Start time calculate for each transaction?

xp001975 — Mon, 27 Feb 2023 22:53:15 GMT

I am trying | eval EndTime = strptime(_time, "%Y-%m-%d %H:%M:%S.%3N%Z") | eval timetoserveRequst = strptime(time_to_serve_request, ".%3N%Z") | eval startTIme = EndTime - timetoserveRequst
| table startTIme EndTime

But Nothing is getting displayed

Re: Start time calculate for each transaction?

xp001975 — Mon, 27 Feb 2023 23:19:17 GMT

This is one event .

want to calculate the start time by deducting time to serve request (millisec) from _time .

Re: Start time calculate for each transaction?

xp001975 — Mon, 27 Feb 2023 23:36:38 GMT

i tried but nothing is coming in the output

Re: Start time calculate for each transaction?

bowesmana — Tue, 28 Feb 2023 00:08:00 GMT

_time is already in epoch, so if your 'end time' is actually the _time field, just subtract the millseconds / 1000

Re: Start time calculate for each transaction?

xp001975 — Tue, 28 Feb 2023 04:25:28 GMT

Still no luck

Re: Start time calculate for each transaction?

bowesmana — Tue, 28 Feb 2023 07:12:20 GMT

Please add the time_to_serve_request in the table.

Generally if a field is blank it means that its dependencies are not what you expect them to be

Re: Start time calculate for each transaction?

xp001975 — Tue, 28 Feb 2023 19:13:33 GMT

Do you have any help here ?

Re: Start time calculate for each transaction?

xp001975 — Tue, 28 Feb 2023 19:14:25 GMT

Do you have any query to help ?

Re: Start time calculate for each transaction?

ITWhisperer — Tue, 28 Feb 2023 19:17:18 GMT

| eval starttime=_time-(time_to_serve_request/1000)

Re: Start time calculate for each transaction?

bowesmana — Tue, 28 Feb 2023 22:15:12 GMT

If you have a field called time_to_serve_request in your data and it has a numeric value, then the eval statement should work.

Please add time_to_serve_request in your table statement and post here the screenshot.

Re: Start time calculate for each transaction?

xp001975 — Wed, 01 Mar 2023 05:04:14 GMT

Start time is not coming in YYYY-MM-DD HH:MM:SS.millisec format

Re: Start time calculate for each transaction?

bowesmana — Wed, 01 Mar 2023 06:53:10 GMT

Epoch times are in seconds, so if you want to display those as localised text based dates, you need to convert them. The _time field is different in that it IS epoch, but it is always shown in a text form.

To convert the start time to a text form use strftime

| eval starttime=strftime(_time-(time_to_serve_request/1000), "%F %T.%Q")