topic Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format? in Splunk Search

Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

changux — Tue, 04 Aug 2015 18:21:52 GMT

Hi all.

I have two fields, in with values like 2015-08-04 05:52:42 and out with values like "2015-08-04 06:18:30" in the same record.

in = 2015-08-04 05:52:42
out = 2015-08-04 06:18:30

I need to calculate the time difference between out and in. I am using:

... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= goout - comein

I have a resulting field called diff with the time difference in epoch time (is a relative time like 226.000000).

I tried to convert this to human readable format using:

... | convert timeformat="%M:%S" ctime(diff)

But the resulting value doesn't properly convert the quantity in hours, only minutes and secs. Any way to show the difference like 20h,20m,20secs for example?

Thanks!

Re: Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

ppablo — Tue, 04 Aug 2015 18:37:24 GMT

Hi @changux

I think you forgot the %H in your timeformat conversion. so it should be:

... | convert timeformat="%H:%M:%S" ctime(diff)

Re: Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

somesoni2 — Tue, 04 Aug 2015 18:39:49 GMT

Try something like this

 ... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= tostring(goout - comein,"duration")

Re: Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

changux — Tue, 04 Aug 2015 19:04:15 GMT

Thanks Pablo. When I add the %H, returned in this case 19H, when the difference is less than 1 h, why?

Re: Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

changux — Tue, 04 Aug 2015 20:23:31 GMT

Works great, thanks!

Re: Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

ppablo — Tue, 11 Aug 2015 00:11:44 GMT

ah sorry for the delayed response. not sure actually, but I'm glad you got a working answer from @somesoni2 🙂