https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643275#M222830 <P>Can anyone offer some guidance on how to go about creating a query that pulls the following fields from each event&nbsp;</P> <P>Start_time (date and time ) — different from _time field&nbsp;</P> <P><SPAN>End_time (date and time )&nbsp;— different from _time field&nbsp;</SPAN></P> <P><SPAN>usage_amount ( a whole number)&nbsp;</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>I will like to calculate the time difference between the start and end time and split every event that the start and end time span over one day and split the original event into multiple individual events where each event from the search just returns the modified list of events where the start and end times are within the same day&nbsp;</P> Mon, 15 May 2023 14:01:28 GMT Strangertinz 2023-05-15T14:01:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643275#M222830 <P>Can anyone offer some guidance on how to go about creating a query that pulls the following fields from each event&nbsp;</P> <P>Start_time (date and time ) — different from _time field&nbsp;</P> <P><SPAN>End_time (date and time )&nbsp;— different from _time field&nbsp;</SPAN></P> <P><SPAN>usage_amount ( a whole number)&nbsp;</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>I will like to calculate the time difference between the start and end time and split every event that the start and end time span over one day and split the original event into multiple individual events where each event from the search just returns the modified list of events where the start and end times are within the same day&nbsp;</P> Mon, 15 May 2023 14:01:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643275#M222830 Strangertinz 2023-05-15T14:01:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643276#M222831 <P>You want to start by telling the community about your data. (Anonymize as needed.) &nbsp;How do you determine what is Start_time, what is End_time, what is usage_amount, etc.? &nbsp;SPL is just a tool. &nbsp;Until you can show volunteers how you do it without SPL, we cannot help you craft SPL.</P> Sat, 13 May 2023 23:06:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643276#M222831 yuanliu 2023-05-13T23:06:57Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643279#M222832 <P>I attached some picture of the sample data and query thus far<span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Screen Shot 1.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25371i3D91D377988BB2D7/image-size/large?v=v2&amp;px=999" role="button" title="Screen Shot 1.png" alt="Screen Shot 1.png" /></span></P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Screen Shot 2.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25370i75D125C54FA4C306/image-size/large?v=v2&amp;px=999" role="button" title="Screen Shot 2.png" alt="Screen Shot 2.png" /></span></P><P>&nbsp;</P> Sun, 14 May 2023 01:57:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643279#M222832 Strangertinz 2023-05-14T01:57:52Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643280#M222833 <P>Thanks, I posted some pictures of the data/current SPL query. Let me know if I can provide anything else&nbsp;</P> Sun, 14 May 2023 01:59:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643280#M222833 Strangertinz 2023-05-14T01:59:24Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643285#M222834 <P>Try something like this</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ITWhisperer_0-1684045746990.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25373i41FFD99F5C688346/image-size/medium?v=v2&amp;px=400" role="button" title="ITWhisperer_0-1684045746990.png" alt="ITWhisperer_0-1684045746990.png" /></span></P><P>&nbsp;</P> Sun, 14 May 2023 06:29:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643285#M222834 ITWhisperer 2023-05-14T06:29:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643293#M222835 <P>This is awesome! Thanks !!!</P> Sun, 14 May 2023 16:27:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-query-that-pulls-the-following-fields-from-each/m-p/643293#M222835 Strangertinz 2023-05-14T16:27:27Z