How to create a Splunk search to get the system uptime based on EventId=6013?

[samadhuazad]

index="tbv" source="winevents" ComputerName="CSPV-MTL-GCS-GAME1" EventID=6013

The EventID=6013, it fetches the system uptime in seconds [example: The system uptime is 18 seconds.] in the MessageString field.

Need help to add all the system uptime and show the Total value in hours.

[harishsplunk7]

Assuming uptime values makes sense: for this example first two lines have the same starting time.
And timestamp is recognized as _time field,

If the source looks like this:

|makeresults |eval a="time=15-01-2023 02:05:34.00, uptime=1231 BR
time=15-01-2023 02:45:32.00, uptime=3629 BR
time=16-01-2023 06:03:15.00, uptime=93253" |table a
|makemv delim="BR" a |mvexpand a |rename a as _raw |extract |eval _time=strptime(time,"%d-%m-%Y %H:%M:%S") |table _time uptime

_time uptime
--------------------------------
2023-01-15 02:05:34 1231
2023-01-15 02:45:32 3629
2023-01-16 06:03:15 93253

Then the following query will calculate the precentage of uptime and downtime

|makeresults |eval a="time=15-01-2023 02:05:34.00, uptime=1231 BR
time=15-01-2023 02:45:32.00, uptime=3629 BR
time=16-01-2023 06:03:15.00, uptime=93253" |table a
|makemv delim="BR" a |mvexpand a |rename a as _raw |extract |eval _time=strptime(time,"%d-%m-%Y %H:%M:%S") |table _time uptime

|eval start=_time-uptime,end=_time |eval startc=start,endc=end
|convert ctime(*c) |sort - _time |dedup start |reverse | streamstats values(end) as before_end window=1 current=f |eval downtime=start-before_end |stats sum(uptime) as uptime sum(downtime) as downtime
|eval overall=uptime+downtime |eval uptime=(uptime/overall)*100,downtime=(downtime/overall)*100 |table uptime downtime
Result:

uptime downtime
95.08 4.92