Hi splunkers,
i m trying to calculate the time differece in minutes between the two fields sla_time and FILE_ARRIVALTIME . It seems the correct query for me , but not getting the time difference value from the following query. Any of you can help?
query:
| inputlookup SLA.csv |table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD|eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d"))|eval sla_time=replace (sla_time,","," ") |table SOR_NAME sla_time |join type=outer SOR_NAME [search index=xxx|rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)"|rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") |fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] |eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M")| eval time_diff = tostring((FILE_ARRIVALTIME_epoch-sla_time_epoch), "duration") |table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME time_diff
@pench2k19
Can you please confirm below search will have data in all fields ( SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch
) ??
| inputlookup SLA.csv
| table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD
| eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d"))
| eval sla_time=replace (sla_time,","," ")
| table SOR_NAME sla_time
| join type=outer SOR_NAME
[ search index=xxx
| rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)"
| rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$"
| eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S")
| eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3)
| eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M")
| fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch]
| eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M")
| table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch
Thanks
yes it does have all the fields....
Can you please share sample results ( first 5 rec) ?
@vnravikumar