https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171333#M49066 <P>Hello,</P> <P>Let me ask this simple question. <BR /> I have following two fields; start_time and end_time.<BR /> I would like to calculate the duration time by using these two fields.<BR /> In my understanding, if I want to use transaction startswith= endswith=, I need to specify the value like startswith="login" endswith="logout", that way I can get duration. <BR /> In my case, however, each fields has specific time value, so if I want to calculate the duration between start_time and end_time, how do I do that?</P> <P>Thank you.</P> Mon, 28 Sep 2020 15:26:44 GMT appleman 2020-09-28T15:26:44Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171333#M49066 <P>Hello,</P> <P>Let me ask this simple question. <BR /> I have following two fields; start_time and end_time.<BR /> I would like to calculate the duration time by using these two fields.<BR /> In my understanding, if I want to use transaction startswith= endswith=, I need to specify the value like startswith="login" endswith="logout", that way I can get duration. <BR /> In my case, however, each fields has specific time value, so if I want to calculate the duration between start_time and end_time, how do I do that?</P> <P>Thank you.</P> Mon, 28 Sep 2020 15:26:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171333#M49066 appleman 2020-09-28T15:26:44Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171334#M49067 <PRE><CODE>... | eval diff=end_time-start_time </CODE></PRE> <P>?</P> Mon, 09 Dec 2013 07:04:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171334#M49067 Ayn 2013-12-09T07:04:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171335#M49068 <P>No, it didn't work.</P> Mon, 09 Dec 2013 07:10:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171335#M49068 appleman 2013-12-09T07:10:26Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171336#M49069 <P>OK. You <EM>could</EM> consider telling us a bit more about exactly what your events look like, the problem you're trying to solve, how things are not working, etc etc? Just putting it out there <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 09 Dec 2013 07:12:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171336#M49069 Ayn 2013-12-09T07:12:23Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171337#M49070 <P>Well, for example, I have fields start_time=2013/11/26 20:28 and end_time=2013/11/26 20:35. These fields represent the time when a meeting starts and ends. I'd like to get the meeting time by search command like transaction(?), so in this case I expect to get "7min" as a result. Hope it helps you a bit to understand what I want to get.</P> Mon, 28 Sep 2020 15:26:47 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171337#M49070 appleman 2020-09-28T15:26:47Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171338#M49071 <P>In that case wrap strptime() calls around the field names in Ayn's eval to parse the time into epoch time. Your formatting string might be "%Y/%m/%d %H:%M".</P> Mon, 09 Dec 2013 09:20:12 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171338#M49071 martin_mueller 2013-12-09T09:20:12Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171339#M49072 <P>strptime did work. Thank you!</P> Wed, 11 Dec 2013 09:49:28 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-transaction-if-the-start-time-and-end-time-fields/m-p/171339#M49072 appleman 2013-12-11T09:49:28Z