Getting Data In

Time differece

aquillius
New Member

How to get the total hours rendered if i have fields start_time and end_time

ex. 09:00-18:00 = 9

Tags (1)
0 Karma

somesoni2
Revered Legend

As suggested by @linu1988, you would have to convert your start_time and end_time to epoch for it. Try this.

your base search ..| eval time_diff=floor(strptime(start_time,"%H:%M")-strptime(end_time,"%H:%M")/3600) | ..rest of the search

Also note that you may have to adjust timestamp format for strptime command. Based on your sample values (09:00, 18:00) its "%H:%M". The format should be exactly as in your field value.

0 Karma

linu1988
Champion

Hello,
You need to do some query. if you have the time in epoch format the work is easier or you need to convert them to epoch and then get the time difference.

source=x |eval start=strptime("%m/%d/%Y %H:%M:%S,start_time )|eval end=strptime("%m/%d/%Y %H:%M:%S",end_time)|eval hr=(end-start)/3600|eval hr=floor(hr)

for minutes and second you need to calculate. The difference will not give you the correct result if direct the convert it using strftime().

Thanks

joebensimo
Path Finder

In your example, are the 09:00 and 18:00 elapsed time or time of day?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...