Hi,
I am trying to calculate the duration of a call from the bellow search however it is appearing blank, the format is 01/01/2015 13:26:29.64321574:
index=test sourcetype=test
| eval created=strptime(starttime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval last_time=strptime(endtime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval diff=(last_time-created) | eval diff = round(diff/60/60/24)
| table diff
Any help would be greatly appreciated.
Thanks
Hi @joe06031990,
You are using a wrong conversion format in strptime, please try this:
index=test sourcetype=test
| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff
Then, probably, it's better to use the tostring option to display duration.
Ciao.
Giuseppe
I think you should use "/" instead of "-" between day,month,year.
Your example " 01/01/2015 13:26:29.64321574:" expects something like "%d/%m/%Y %H:%M:%S.%8N")
01/01/2015 13:26:29.64321574 is not conform "%Y-%m-%dT%H:%M:%S.%3N" I assume
Hi @joe06031990,
you have to use the same format of you time in the strptime function, if you have
02/01/2015 13:26:29.64321574
where 02 id day, 01 is month, 2015 is year, 13 is the hour, 26 is the minute, 29 is the second and 64321574 are 8 number after seconds,
you have to use %d/%m/%Y %H:%M:%S.%8N
In other words, you have to exactly use the same format, also in spaces and characters (as "/").
Ciao.
Giuseppe
Hi @joe06031990,
You are using a wrong conversion format in strptime, please try this:
index=test sourcetype=test
| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff
Then, probably, it's better to use the tostring option to display duration.
Ciao.
Giuseppe
Hi @joe06031990,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated by all the Contributors 😉
Hi,
Just tried however it is still showing as blank for
created
last_time
diff
index=test sourcetype=test| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff