Calculating the duration

[joe06031990]

Hi,

I am trying to calculate the duration of a call from the bellow search however it is appearing blank, the format is  01/01/2015 13:26:29.64321574:

index=test sourcetype=test
| eval created=strptime(starttime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval last_time=strptime(endtime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval diff=(last_time-created) | eval diff = round(diff/60/60/24)
| table diff

Any help would be greatly appreciated.

Thanks

[rrovers]

I think you should use "/" instead of "-" between day,month,year.

Your example " 01/01/2015 13:26:29.64321574:" expects something like "%d/%m/%Y %H:%M:%S.%8N")

[rrovers]

 01/01/2015 13:26:29.64321574 is not conform "%Y-%m-%dT%H:%M:%S.%3N" I assume

[gcusello]

Hi @joe06031990,

you have to use the same format of you time in the strptime function, if you have

02/01/2015 13:26:29.64321574

where 02 id day, 01 is month, 2015 is year, 13 is the hour, 26 is the minute, 29 is the second and 64321574 are 8 number after seconds,

you have to use %d/%m/%Y %H:%M:%S.%8N

In other words, you have to exactly use the same format, also in spaces and characters (as "/").

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @joe06031990,

You are using a wrong conversion format in strptime, please try this:

index=test sourcetype=test
| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff

Then, probably, it's better to use the tostring option to display duration.

Ciao.

Giuseppe

[gcusello]

Hi @joe06031990,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

[joe06031990]

Hi,

Just tried however it is still showing as blank for 

created

last_time

diff

index=test sourcetype=test| eval created=strptime(starttime,"%d-%m-%Y %H:%M:%S.%8N")
| eval last_time=strptime(endtime,"%d-%m-%Y %H:%M:%S.%8N")
| eval diff=tostring(last_time-created,"duration")
| table diff