topic Re: Calculating duration from a number in Splunk Search

Calculating duration from a number

whipstash — Mon, 08 Apr 2024 21:39:05 GMT

I am trying to find the duration for a time span. The "in" and "out" numbers are included in the data as type: number. I attempted:

in = 20240401183030

out = 20240401193030

| convert mktime(in) AS IN
| convert mktime(out) AS OUT
| eval Duration =OUT - IN

I have not been able to find a function that would directly convert number to time or if there is some multifunctional way to get the right duration between the two,

But this does not perform the correct time math.

Re: Calculating duration from a number

ITWhisperer — Mon, 08 Apr 2024 22:13:03 GMT

| eval IN = strptime(in, "%Y%m%d%H%M%S") | eval OUT = strptime(out, "%Y%m%d%H%M%S") | eval Duration = tostring(OUT - IN,"duration")

Re: Calculating duration from a number

whipstash — Mon, 08 Apr 2024 22:28:51 GMT

Thanks ITWhisperer! I did try the string conversion, but it did not work. This looks like it did the trick!

Re: Calculating duration from a number

PickleRick — Tue, 09 Apr 2024 07:42:54 GMT

The "convert mktime()" could also be the way to go but you need to specify the time format with... the "timeformat=" option. Otherwise Splunk has to guess and usually guesses wrong.