Splunk Search

Difference between two times

mbasharat
Contributor

Hi,

I have two fields in my report. Time_Created and Time_Closed. They are for time an incident ticket was created and then closed.

Their format is:

Time_Created: 12/20/19 11:30
Time_Closed: 1/1/20 16:50

I need to find the difference between both and result in an additional field e.g. Time_to_resolution.

Basically, I need to see how long it took to resolve a ticket from its creation to closure.

Thanks, in advance!!!

Labels (1)
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval Time_Created="12/31/19 11:30",Time_Closed="1/1/20 16:50" 
| eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y %H:%M") -strptime(Time_Created,"%m/%d/%y %H:%M"),0),"duration") 
| eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") |table Time_Created Time_Closed Time_to_resolution

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval Time_Created="12/31/19 11:30",Time_Closed="1/1/20 16:50" 
| eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y %H:%M") -strptime(Time_Created,"%m/%d/%y %H:%M"),0),"duration") 
| eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") |table Time_Created Time_Closed Time_to_resolution
0 Karma

mbasharat
Contributor

Many thanks for promptness. And how about if it is just date only?

Time_Created: 12/20/19
Time_Closed: 1/1/20

To how many days it took.

0 Karma

vnravikumar
Champion

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y") -strptime(Time_Created,"%m/%d/%y"),0),"duration") 
 | eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 day(s)")
0 Karma

mbasharat
Contributor

This is awesome! TY!!! This triggered my curiosity for some additional chart for my use case. How about converting below to month? Either fields with or without time will work because I am using everything you have provided.

Time_Created: 12/20/19 11:30 to MonthCreated=December

Time_Closed: 1/1/20 16:50 to MonthClosed=January

Case statement or whatever is best as you suggest?

0 Karma

vnravikumar
Champion

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval MonthCreated = strftime(strptime(Time_Created,"%m/%d/%y"),"%B"), MonthClosed=strftime(strptime(Time_Closed,"%m/%d/%y"),"%B")
0 Karma

mbasharat
Contributor

Awesome!!! THANK YOU!!!

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...