Splunk Search

Calculating the duration

joe06031990
Communicator

Hi,

I am trying to calculate the duration of a call from the bellow search however it is appearing blank, the format is  01/01/2015 13:26:29.64321574:

 

index=test sourcetype=test
| eval created=strptime(starttime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval last_time=strptime(endtime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval diff=(last_time-created) | eval diff = round(diff/60/60/24)
| table diff

 

 

Any help would be greatly appreciated.

 

Thanks

Labels (6)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

You are using a wrong conversion format in strptime, please try this:

index=test sourcetype=test
| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff

Then, probably, it's better to use the tostring option to display duration.

Ciao.

Giuseppe

View solution in original post

rrovers
Communicator

I think you should use "/" instead of "-" between day,month,year.

Your example " 01/01/2015 13:26:29.64321574:" expects something like "%d/%m/%Y %H:%M:%S.%8N")

rrovers
Communicator

 01/01/2015 13:26:29.64321574 is not conform "%Y-%m-%dT%H:%M:%S.%3N" I assume

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

you have to use the same format of you time in the strptime function, if you have

02/01/2015 13:26:29.64321574

where 02 id day, 01 is month, 2015 is year, 13 is the hour, 26 is the minute, 29 is the second and 64321574 are 8 number after seconds,

you have to use %d/%m/%Y %H:%M:%S.%8N

In other words, you have to exactly use the same format, also in spaces and characters (as "/").

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

You are using a wrong conversion format in strptime, please try this:

index=test sourcetype=test
| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff

Then, probably, it's better to use the tostring option to display duration.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

 

joe06031990
Communicator

Hi,

 

Just tried however it is still showing as blank for 

 

created

last_time

diff

index=test sourcetype=test| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...