Splunk Search

Calculate difference between TIME in host x and TIME in host y


host y contain name tag: ELT (Value: milliseconds)

host x contain name tag: ELT (Value: seconds)

Common identifier in the two hosts are F5I

How do I calculate the difference between ELT in host Y and ELT in host X?

I have tried this search:

host=x | JOIN F5I [ search host=y ]|EVAL yELT=ELT/1000 |TABLE host SVC ELT yELT

But the value of 'ELT' above is the value of ELT in host Y - and I want the value of ELT in host X - in order to calculate the difference - how do I do that?

Thanks in advance for any help.

Tags (1)
0 Karma


found the solution myself!

Put a rename ELT AS YELT into the subsearch - then I can get both the ELT from x and ELT from y
- and thereby calculate the difference between yELT and xELT

host=x | JOIN F5I [ search host=y |rename ELT AS YELT ] |TABLE host SVC ELT YELT

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!