Duration calculation going wrong

[wimvdheijkant]

Dear all,

I'm trying to calculate duration. But what I get returned is off by 2 hours...? I'm using the following:
Search | convert timeformat="%d-%m-%Y %H:%M:%S" mktime(ADCreatedTime) |
convert timeformat="%d-%m-%Y %H:%M:%S" mktime(FIMCreatedTime) |
where ADCreatedTime > FIMCreatedTime |
Eval Duration = ADCreatedTime - FIMCreatedTime |

convert timeformat="%H:%M:%S" ctime(Duration) as D |
convert timeformat="%d-%m-%Y %H:%M:%S" ctime(ADCreatedTime) as ADC |
convert timeformat="%d-%m-%Y %H:%M:%S" ctime(FIMCreatedTime) as FDC |
Table user, FDC, ADC, D

The results are: user FDC ADC D
abiggelaar 25-03-2011 11:02:34 25-03-2011 12:05:49 03:03:15
ahayward 16-02-2011 12:54:59 16-02-2011 13:57:49 03:02:50
beheer.danaher 04-03-2011 09:49:39 04-03-2011 10:53:39 03:04:00

I can't find any time zone stuff going wrong. Can anyone point me in the right direction? Thanks! Wim

[wimvdheijkant]

Problem solved, thanks!

[alacercogitatus · Accepted solution]

The convert that you are doing on Duration converts the duration into a time based on the epoch. So its saying that Duration is 3 hours 3 minutes 15 seconds from the epoch (for abiggelaar). You want to use an eval tostring evaluation. Replace convert timeformat="%H:%M:%S" ctime(Duration) as D with eval D=tostring(Duration,"duration") and it should give you what you want.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions