Splunk Search

2 timestamp, the rest identical, how calculate duration ?

splunkLPN
Path Finder
tim:2019-01-18 10:27:54,id:bee236
tim:2019-01-18 10:38:07,id:bee236
tim:2019-01-21 09:27:09,id:thierry403
tim:2019-01-21 09:37:21,id:thierry403

cherry on the cake : the duration is near 10 min. So I will search bots who made a second try in time between 595 and 605secs.
If tools on frequency could be more practical or efficient all solutions are welcome 🙂
thx for your help

0 Karma
1 Solution

nickhills
Ultra Champion

try this:

[your search|transaction id|eval dur_seconds=round((duration/1000),0)|table _time id dur_seconds
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

splunkLPN
Path Finder

simple and efficient

0 Karma

nickhills
Ultra Champion

try this:

[your search|transaction id|eval dur_seconds=round((duration/1000),0)|table _time id dur_seconds
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!