Getting Data In

Subtract static value from list

dheri
Engager

I am trying to get time difference between 2 timestamps, I have one field deployment_ts with one value and list of time stamps commit_ts, i want a list containing the difference for each value in list with the other field eval commit_to_rel = (deployment_ts - commit_ts). Bu t I am not getting any result.

here is my query


index=x application_name="yy-xx-zz" event_type="ev"
| spath path=commits{}.date output=commit_date
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%z"))
| eval commit_ts = (strptime(commit_date, "%Y-%m-%dT%H:%M:%SZ"))
| eval commit_to_rel = (deployment_ts - commit_ts)
| stats list(commit_date), list(commit_ts), list(deployment_ts), list(commit_to_rel)

Can anyone please tell me how to get this done?

here is the picture of results along with the querry.

alt text

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @dheri,

Try this :

index=x application_name="yy-xx-zz" event_type="ev"
| spath path=commits{}.date output=commit_date 
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z"))
| eval commit_ts = (strptime(commit_ts, "%Y-%m-%dT%H:%M:%SZ"))
| mvexpand commit_ts
| eval commit_to_rel =  (deployment_ts - commit_ts)

Let me know if that helps.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @dheri,

Try this :

index=x application_name="yy-xx-zz" event_type="ev"
| spath path=commits{}.date output=commit_date 
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z"))
| eval commit_ts = (strptime(commit_ts, "%Y-%m-%dT%H:%M:%SZ"))
| mvexpand commit_ts
| eval commit_to_rel =  (deployment_ts - commit_ts)

Let me know if that helps.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @dheri Was that helpful ? Can you let me know if it worked for you ?

0 Karma

dheri
Engager

Yes, I was able to expand single event into multiple events.

0 Karma

DavidHourani
Super Champion

Awesome ! Great to hear that !

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dheri

Is the date format for deployment_time and commit_date are the same? If not, can you please share it else pls try below search?

| makeresults 
| eval _raw="{\"deployment_time\": \"2019-06-03T15:41:26Z\",\"commit_date\": \"2019-06-03T15:41:26Z\"}" 
| kv 
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z")) 
| eval commit_ts = (strptime(commit_date, "%Y-%m-%dT%H:%M:%SZ")) 
| eval commit_to_rel = (deployment_ts - commit_ts)

Just made change in | eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%Z"))

0 Karma

dheri
Engager

@kamlesh_vaghela
Yes, there is difference between date format of deployment_time and commit_date but they both are converted into unix timestamps, which I can see in result as deployment_ts and commit_ts. I tried the query you asked me. Here are the results
alt text

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!