Getting Data In

How to calculate duration from now with a different time field?

power12
Communicator

I have the following event

2023-01-25T20:20:45.429989-08:00 abc log-inventory.sh[20519]: Boot timestamp: 2023-01-25 20:15:56

 

I am trying to extract the Boot timestamp and then calculating the difference between current - Boot timestamp

 

I used following search

index=abc
| rex field=_raw "Boot\s*timestamp\:\s*(?<Boot_Time>[^.*]+)"
| stats Latest(Boot_Time) as Boot_Time latest(_time) as time by host|eval diff = now() - Boot_Time but it shows no results

0 Karma

power12
Communicator

I used the below search and it worked

| stats Latest(Boot_Time) as Boot_Time   by host
| eval epoch1=strptime(Boot_Time,"%Y-%m-%d %H:%M:%S") 
| eval current=now()
| eval ctime=strftime(current,"%Y-%m-%d %H:%M:%S")
 | eval diff=tostring(current- epoch1,"duration")
| table host Boot_Time ctime diff
| rename ctime as Current_Time diff as Duration
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...