Splunk Search
Highlighted

Difference between Start and End Time

Communicator

I have a event, where starttime and endtime are coming as string. I am using below query.

.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | eval  Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration

With help of this query, I am able to get the right value for Start and End time, but duration is coming 00:00 as both time are in different format. I Tried to convert both time in same format using convert function but getting blank value.

.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | convert ctime(Start_Time) | convert ctime(End_Time) | eval  Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration

Can anyone help me to get the difference of Start and End time.

Thanks in advance.

0 Karma
Highlighted

Re: Difference between Start and End Time

Champion

Please convert EndTime to epoch time and calculate Duration.
eval End
Time=strptime(End_Time,"your format")

> | convert ctime(StartTime) | convert ctime(EndTime)
ctime needs an epoch time. Strings can not be used.

> |eval StartTime=strftime(time, "%H:%M;%S")
Start_Time:String
_time:epoch time

If duration is 00:00, check the _time of the transaction start and end logs.

0 Karma
Highlighted

Re: Difference between Start and End Time

Communicator

I tried to convert format for End_Time but getting blank value for that field. I used below query now.

... "Start time for " |eval Start_Time=strftime(_time, "%H:%M:%S") |sort -Start_Time   | table  Start_Time | appendcols [ search ..... "End time for " |eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strftime(End_Time, "%H:%M:%S") | eval Duration= End_Time
-Start_Time |sort -End_Time | table  End_Time ]  | table Start_Time End_Time Duration
0 Karma
Highlighted

Re: Difference between Start and End Time

Champion

Please show me sample log.

|eval EndTime=substr(EndTime, 11, 9) | eval EndTime=strftime(EndTime, "%H:%M:%S")
|eval EndTime=substr(EndTime, 11, 9) | eval EndTime=strptime(EndTime, "%H:%M:%S")
However, because it is 9 digits, the format is different
"%H:%M:%S"->00:00:00 (8 digits)

0 Karma