Getting Data In

How to calculate duration from now with a different time field?

power12
Communicator

I have the following event

2023-01-25T20:20:45.429989-08:00 abc log-inventory.sh[20519]: Boot timestamp: 2023-01-25 20:15:56

 

I am trying to extract the Boot timestamp and then calculating the difference between current - Boot timestamp

 

I used following search

index=abc
| rex field=_raw "Boot\s*timestamp\:\s*(?<Boot_Time>[^.*]+)"
| stats Latest(Boot_Time) as Boot_Time latest(_time) as time by host|eval diff = now() - Boot_Time but it shows no results

Labels (1)
0 Karma

power12
Communicator

I used the below search and it worked

| stats Latest(Boot_Time) as Boot_Time   by host
| eval epoch1=strptime(Boot_Time,"%Y-%m-%d %H:%M:%S") 
| eval current=now()
| eval ctime=strftime(current,"%Y-%m-%d %H:%M:%S")
 | eval diff=tostring(current- epoch1,"duration")
| table host Boot_Time ctime diff
| rename ctime as Current_Time diff as Duration
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...