Archive

using eval to calculate time between events not working

Path Finder

I am trying to use eval to calculate the time between events. Those events have a unique ID.
This is the sarch that I have now:

 <my search> 
| eval Test =if(message.information=="some_data",_time,null()) 
| eval Test2=if(message.information="some_data_2" ,_time,null()) 
| eval Test3 = Test - Test2 
| table _time Test Test2 Test3

I am doing something wrong I guess because I only see values in the _time column, the rest is empty.
alt text

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi Mike6960,

you need to put your message.information fields in single quotes ' like this:

<my search> 
 | eval Test =if('message.information'=="some_data",_time,null()) 
 | eval Test2=if('message.information'="some_data_2" ,_time,null()) 
 | eval Test3 = Test - Test2 
 | table _time Test Test2 Test3

because they contain a . and this is a special case when using eval()

Take a look at this run everywhere SPL:

| makeresults 
| eval message.information="1", foo="2" 
| eval Test =if('message.information'=="1",now(),null()) 
| eval Test2=if('message.information'=="2" ,null(),relative_time(now(), "-1sec")) 
| eval Test3 = Test - Test2 
| table _time Test Test2 Test3

Hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi Mike6960,

you need to put your message.information fields in single quotes ' like this:

<my search> 
 | eval Test =if('message.information'=="some_data",_time,null()) 
 | eval Test2=if('message.information'="some_data_2" ,_time,null()) 
 | eval Test3 = Test - Test2 
 | table _time Test Test2 Test3

because they contain a . and this is a special case when using eval()

Take a look at this run everywhere SPL:

| makeresults 
| eval message.information="1", foo="2" 
| eval Test =if('message.information'=="1",now(),null()) 
| eval Test2=if('message.information'=="2" ,null(),relative_time(now(), "-1sec")) 
| eval Test3 = Test - Test2 
| table _time Test Test2 Test3

Hope this helps ...

cheers, MuS

View solution in original post

Path Finder

@MuS Thanks, this works. I now only have to convert to normal time, because I get a number as result. Is there a way to show one line per ID? What I mean is that in the example I gave there are always tow events per ID. Ik want one line per ID.

0 Karma

SplunkTrust
SplunkTrust

Sorry, but there is no id in this question and I also don't know what your events look like or your expected output looks like. This is really up to you to figure it out or accept this answer and post a new one with more details.

cheers, MuS

0 Karma

Path Finder

Ok, thank you for your help with my initial question

0 Karma

SplunkTrust
SplunkTrust

You're welcome 🙂

cheers, MuS

0 Karma

Path Finder

@MuS , also the field Test3 remains empty...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!