Splunk Search

Calculating difference between two timestamp

Jananee_iNautix
Explorer

Hi ,

There are two fields named "start_time" and "end_time" extracted from logs and displayed in the format "03/21/14 01:11:13".Can someone tell the search query on how to calculate the differnce between two time and display the difference in terms of seconds.For example

Start_time End_time duration
03/21/14 01:11:13 03/21/14 01:11:15 2

Tags (1)
0 Karma
1 Solution

kbecker
Communicator

Use the convert command to change them too epoch time. Then use eval to get the difference. In seconds.

View solution in original post

kbecker
Communicator

Use the convert command to change them too epoch time. Then use eval to get the difference. In seconds.

martin_mueller
SplunkTrust
SplunkTrust

I often find the various functions of convert to be confusing to beginners, so here's a working example:

| stats count | eval startTime = "03/21/14 01:11:13" | eval endTime = "03/21/14 01:11:15" | convert mktime(*Time) timeformat="%m/%d/%y %H:%M:%S" | eval diff = endTime - startTime
0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...