Splunk Search

Dealing with Datetime in Splunk Henny!

andres91302
Communicator

Hello respected members of the prestigious forum of Splunk

I have been working with datetimes in splunk and it is making me insane... I am extracting the datetime of two separate events to later on subtract them, I have tried many ways to achieve this but I still dont have the results that I want... the format of datetime of the events look like this:  2020-07-28T09:42:33-06:00 I want to be able to have calculate difference in minutes between to events "join" by the field: error-code... Because of the way the system is configured the error "adult.mov" may appear twice or three times but I am only interested in the first time it appeared ... However, if this error has not appeared yet I want to record the current time instead... I am trying something like this:

 

| eval terrorXYU=if(match(_raw, "e_type_k"),datetime_c, null)
| eval terroradult.mov=if(match(_raw, "mov"),datetime_c, null)
| eval terroradult.mov= strptime(terroradult.mov,"%m/%d/%Y %H:%M:%S:%3N")
| eval terrorXYU= strptime(terrorXYU,"%m/%d/%Y %H:%M:%S:%3N")
| eval diff= terroradult.mov-terrorXYU

 

but I get nothing ins return I have tried a most of the codes in other posts but no luck at all.. thank you for helping me indeed

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...