https://community.splunk.com/t5/Splunk-Search/Start-End-time-Displaying-Same-time/m-p/168262#M47977 <P>I have a search where I'd like to show the duration of the order.</P> <P>My search below almost gives me that, but the start_time and end_time are showing as the same, giving duration a value of 0.000</P> <P>Here is my search:</P> <P>index=cg sourcetype=esb_audit esb_top_level=1 NOT bp_bp_name="*Task" svc_context_name="$svc_context_name$" | stats min(_time) as start_time, max(_time) as end_time, earliest(status) as start_status, latest(status) as exit_status, first(other) as exit_message, last(total) as total by svc_context_name, _time |eval duration = (end_time-start_time) |convert ctime(start_time) |convert ctime(end_time) |search exit_status="SUCCESS" |table svc_context_name, start_time, end_time, start_status, exit_status, exit_message, duration</P> <P>I've also tried doing ...|stats earliest(time) as start_time, latest(time) as end_time, etc...| But I get the same results.</P> <P>Is there a way to modify this search to get more accurate start/end time values?</P> <P>Thanks!</P> Mon, 28 Sep 2020 15:59:43 GMT _gkollias 2020-09-28T15:59:43Z https://community.splunk.com/t5/Splunk-Search/Start-End-time-Displaying-Same-time/m-p/168262#M47977 <P>I have a search where I'd like to show the duration of the order.</P> <P>My search below almost gives me that, but the start_time and end_time are showing as the same, giving duration a value of 0.000</P> <P>Here is my search:</P> <P>index=cg sourcetype=esb_audit esb_top_level=1 NOT bp_bp_name="*Task" svc_context_name="$svc_context_name$" | stats min(_time) as start_time, max(_time) as end_time, earliest(status) as start_status, latest(status) as exit_status, first(other) as exit_message, last(total) as total by svc_context_name, _time |eval duration = (end_time-start_time) |convert ctime(start_time) |convert ctime(end_time) |search exit_status="SUCCESS" |table svc_context_name, start_time, end_time, start_status, exit_status, exit_message, duration</P> <P>I've also tried doing ...|stats earliest(time) as start_time, latest(time) as end_time, etc...| But I get the same results.</P> <P>Is there a way to modify this search to get more accurate start/end time values?</P> <P>Thanks!</P> Mon, 28 Sep 2020 15:59:43 GMT https://community.splunk.com/t5/Splunk-Search/Start-End-time-Displaying-Same-time/m-p/168262#M47977 _gkollias 2020-09-28T15:59:43Z https://community.splunk.com/t5/Splunk-Search/Start-End-time-Displaying-Same-time/m-p/168263#M47978 <P>See my updated answer on your other question <A href="http://answers.splunk.com/answers/124706/help-displaying-duration-of-all-orders-of-a-single-ordertype">here.</A> Does this help?</P> Thu, 27 Feb 2014 14:12:17 GMT https://community.splunk.com/t5/Splunk-Search/Start-End-time-Displaying-Same-time/m-p/168263#M47978 wpreston 2014-02-27T14:12:17Z