Hi, I have a field called time_diff that I've eval'd from two other fields to calculate the difference in time between those fields. The calculation is working fine and when I strftime the time_diff back to human readable, I'm using
eval time_diff_final=strftime(time_diff, "%H:%M:%S.%3Q")
When I display the result of time_diff I see
0.13400
However when I look at the result of time_diff_final I see this.
19:00:00.134
The milliseconds is the correct calculation, but for some reason instead of putting a zero in the %H field I'm getting 19 for every single result.
Any ideas?
Thanks!
You are actually getting duration in seconds as outcome not epoc, strftime function accepts epoc and returns as per format. your time_diff is difference in seconds.
-----
An upvote would be appreciated if it helps!
Sure, here is that part of the SPL.
| eval new_attimestamp=strptime('@timestamp',"%Y-%m-%dT%H:%M:%S.%3Q")
| eval new_mdctime=strptime('mdc.time',"%Y-%m-%dT%H:%M:%S.%3Q")
| eval time_diff=(new_attimestamp-new_mdctime)
| eval time_diff_final=strftime(time_diff,"%H:%M:%S.%3")
You are actually getting duration in seconds as outcome not epoc, strftime function accepts epoc and returns as per format. your time_diff is difference in seconds.
-----
An upvote would be appreciated if it helps!
I just ran a test and did this to see how formatting would be for a day or more time difference.
| eval time_diff=(1623704985-new_mdctime). (the # is June 14, 2021 9:09:45 PM)
against this date:
2021-06-11T21:48:28.254Z
Which has a strptime of1623462508.254000
I get a difference of:
242476.746000
Any idea how to get it formatted properly so it shows hours, minutes, seconds and milliseconds?
Thanks!
Hi @timm7474
This might work but need through testing, a good way to start!
| makeresults
| eval time_diff=242476.746000
| eval n=time_diff/3600
| eval m=(n-floor(n))*60, s=round((m-floor(m))*60,3), mf=if(m > 1, floor(m), 0), h=floor(n)
| eval TIME_DIFF=h.":".mf.":".s
Output TIME_DIFF = 67:21:16.746 , h:m:s.3Q format
---
An upvote would be appreciated if it helps!
Can you share few samples of time_diff?
0.114000
0.011000
and time_diff_final looks like this for the above values. And you can see the 19 added when I add hour %H.
19:00:00.114
19:00:00.011