Find Latency in Days

[bmer]

I have a splunk where one of the eval method as part of main splunk query is as below.Iam not sure why SnapshotTimestamp is divided by 1000 but I presume it could be done to convert it to seconds.Sorry am a newbie

| eval snapshot_processed = strftime(SnapshotTimestamp/1000, "%Y-%m-%d %H:%M:%S")

Iam trying to find the # of days clasped between "snapshot_processed" and today. I tried to modify the splunk as below and then try to view the table for "latencyInDays".However it does not return any value.

| eval nowstring=now()
| eval latencyInDays=(nowstring-snapshot_processed)/86400

 What am I missing?

[richgalloway]

The query is mixing strings (snapshot_processed) with integers (nowstring), which Splunk cannot do.  Try this

| eval latencyInDays=(now() - SnapshotTimestamp/1000)/86400

[livehybrid · Accepted solution]

Hi @bmer 

Is your SnapshotTimestamp in milliseconds? Im assuming so because you're dividing by 1000.

You should be able to do this:

| eval latencyInDays=floor((now()-(SnapshotTimestamp/1000)) / 86400)

 Here is a full example to test with:

| makeresults 
| eval SnapshotTimestamp=1741788339000
| eval latencyInDays=floor((now()-(SnapshotTimestamp/1000)) / 86400)

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[dural_yyz]

| eval duration = tostring(diff, "duration")

This will output Days & Clock type output.

[isoutamo]

Usually when you are using 1000 with divider and/or multiplier, there have done conversion between ms and s and vice versa.
86400 is 24h in seconds

It's hard to say more without seeing your data/values on those fields.

One way to see it is use 

| eval latencyInDays = tostring(latencyInSeconds, "duration")

and if you want to just show it in screen but keep value still in seconds just replace eval with fieldformat. 

r. Ismo