Splunk Search

Calculating duration from a number

whipstash
Engager

I am trying to find the duration for a time span. The "in" and "out" numbers are included in the data as type: number. I attempted:

in = 20240401183030

out = 20240401193030

| convert mktime(in) AS IN
| convert mktime(out) AS OUT
| eval Duration =OUT - IN

I have not been able to find a function that would directly convert number to time or if there is some multifunctional way to get the right duration between the two,

But this does not perform the correct time math. 

0 Karma

whipstash
Engager

Thanks ITWhisperer! I did try the string conversion, but it did not work. This looks like it did the trick!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The "convert mktime()" could also be the way to go but you need to specify the time format with... the "timeformat=" option. Otherwise Splunk has to guess and usually guesses wrong.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval IN = strptime(in, "%Y%m%d%H%M%S")
| eval OUT = strptime(out, "%Y%m%d%H%M%S")
| eval Duration = tostring(OUT - IN,"duration")
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...