how to calculate starttime and Endtime duration
|08-feb-2019 01:30:18|08-feb-2019 01:30:28
Try this: |eval d1 = strptime(starttime, "%d-%b-%Y %H:%M:%S") | eval d2 = strptime(endtime, "%d-%b-%Y %H:%M:%S") | eval duration_in_seconds = d1 - d2
Hope this helps
Hi @babukumarreddy ,
If I get correctly whay you mean, you have a set of events and you need to calculate the time delta between the earliest and latest event.
You could use stast
command:
<your main search here> | stats first(_time) as End, last(_time) as Start | eval Duration=End-Start | ....
But it would be better if you give more detailed description of your goal.
Hi Pkarpushin
actually iam new to splunk
in my logs starttime and endtime is there need to calculate duration
starttime endtime
|08-feb-2019 01:30:18|08-feb-2019 01:30:28
fieldnames are starttime and endtime