Monitoring Splunk

To find the difference of time between 2 timestamp fields

Real_captain
Path Finder

Hi 

Can you please let me know how we can find the difference of time between 2 timestamp fields.

For example, 2 timestamp fields are in the below format: 

Reception_Time = 06/21/2024 08:58:00.000000 

Processing_End_Time = 06/21/2024 09:52:55.000000

 

Query : 

(index="events_prod_gmh_gateway_esa") SPNLDSCR2406210858000001000 | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM
|eval Time_in = "20" + substr(sRefInt , 9 , 15)
|eval Processing_Start_Time = strptime(HdtIn,"%Y%m%d%H%M%S.%q") , Processing_End_Time = strptime(HdtOut,"%Y%m%d%H%M%S.%q") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q")
|convert ctime(Processing_Start_Time) , ctime(Processing_End_Time) , ctime(Reception_Time)
| table _time , ID_FAMILLE , MSG_TYP_CONV , MSG_TYP_ORIG , sRefInt , Reception_Time , Processing_Start_Time , Processing_End_Time
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have the right idea, but the strptime format strings don't match the example data.  Then simply subtract one from the other to get the difference.  Try this

|eval Processing_Start_Time = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") , 
      Processing_End_Time = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") , 
      Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q"),
      diff = Processing_End_Time - Reception_Time

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Real_captain
Path Finder

Not able to extract the difference. 

Query: 

(index="events_prod_gmh_gateway_esa") SPNLDSCR* | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM
|eval Time_in = "20" + substr(sRefInt , 9 , 15)
|eval Processing_Start_Time = strptime(HdtIn,"%Y%m%d%H%M%S.%q") , Processing_End_Time = strptime(HdtOut,"%Y%m%d%H%M%S.%q") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q")
|eval Processing_Start_Time_1 = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") ,
Processing_End_Time_1 = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") ,
Reception_Time_1 = strptime(Time_in,"%Y%m%d%H%M%S.%q"),
diff = Processing_End_Time_1 - Reception_Time_1
|convert ctime(Processing_Start_Time) , ctime(Processing_End_Time) , ctime(Reception_Time)
| table _time , ID_FAMILLE , MSG_TYP_CONV , MSG_TYP_ORIG , sRefInt , Reception_Time , Processing_Start_Time , Processing_End_Time , Processing_Start_Time_1 , Processing_End_Time_1 , Reception_Time_1 , diff

Real_captain_1-1719326200641.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are parsing HdtIn and HdtOut twice with strptime using different formats. Only one of the formats is working. Use that to parse the times into epoch format and find the difference between these times.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...