Splunk Search

Dealing with Datetime in Splunk Henny!

andres91302
Communicator

Hello respected members of the prestigious forum of Splunk

I have been working with datetimes in splunk and it is making me insane... I am extracting the datetime of two separate events to later on subtract them, I have tried many ways to achieve this but I still dont have the results that I want... the format of datetime of the events look like this:  2020-07-28T09:42:33-06:00 I want to be able to have calculate difference in minutes between to events "join" by the field: error-code... Because of the way the system is configured the error "adult.mov" may appear twice or three times but I am only interested in the first time it appeared ... However, if this error has not appeared yet I want to record the current time instead... I am trying something like this:

 

| eval terrorXYU=if(match(_raw, "e_type_k"),datetime_c, null)
| eval terroradult.mov=if(match(_raw, "mov"),datetime_c, null)
| eval terroradult.mov= strptime(terroradult.mov,"%m/%d/%Y %H:%M:%S:%3N")
| eval terrorXYU= strptime(terrorXYU,"%m/%d/%Y %H:%M:%S:%3N")
| eval diff= terroradult.mov-terrorXYU

 

but I get nothing ins return I have tried a most of the codes in other posts but no luck at all.. thank you for helping me indeed

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...