How to use a calculated field to calculate overall response time?

[mschellhouse]

We have event records that cut a beginTime and endTime. We have the search necessary to calculate overall response time but would like to try and get logic into a calculated field or ??? so that every user does have to add this to their adhoc query.

Search used to calculate response time:

convert timeformat="%Y/%m/%d %H:%M:%S.%3N" mktime(beginTime) as bTime  mktime(endTime) as eTime | eval RT = eTime-bTime

Any ideas?

[adonio · Accepted solution]

Hi mshcellhouse,
Combining here both comments above.
you can use calculated fields: navigate to settings -> fileds -> calculated fields -> new -> pick an app -> choose sourcetype -> name the newCalculatedField -> use eval (this will replace the convert command)
save it and give it either app permissions or global permissions.
now everyone can use it.
@somesoni extends and give full solution here:
Name of the calculated field - RT
Eval expression: strptime(endTime,"%Y/%m/%d %H:%M:%S.%3N")-strptime(beginTime,"%Y/%m/%d %H:%M:%S.%3N")

See this link for instructions to create one from Splunk Web
https://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/CreatecalculatedfieldswithSplunkWeb

[mschellhouse]

Nailed it! Thanks all!

[adonio]

hi mschellhouse, hope i understand your question,
you can use calculated fields: navigate to settings -> fileds -> calculated fields -> new -> pick an app -> choose sourcetype -> name the newCalculatedField -> use eval (this will replace the convert command)
save it and give it either app permissions or global permissions.
now everyone can use it.

[somesoni2]

Extending @adonio's suggestion, this is what you'll be putting in calculated field

Name of the calculated field - RT
Eval expression: strptime(endTime,"%Y/%m/%d %H:%M:%S.%3N")-strptime(beginTime,"%Y/%m/%d %H:%M:%S.%3N")

See this link for instructions to create one from Splunk Web
https://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/CreatecalculatedfieldswithSplunkWeb