Splunk Search

Duration of a single event

CarmineCalo
Path Finder

Splunkers!

I need to compute the duration of a event, as the difference between the two field (END_TIME and OPEN_TIME).
Time format of END_TIME and OPEN_TIME is the following: 2017-12-31-20.01.37.000000

Code is the following:

| eval END_INC=strptime(CLOSE_TIME, "%b %d %Y %H.%M.%S.%3N%P"), BEG_INC=strptime(OPEN_TIME, "%b %d %Y %H.%M.%S.%3N%P")
| eval duration=END_INC - BEG_INC

Not clear how to set parameters in strptime.

Any help?

Tks!
Carmine

0 Karma
1 Solution

Ayn
Legend

A reference on variables you can use when parsing timestamps with strptime can be found in the docs here: http://docs.splunk.com/Documentation/Splunk/6.6.3/SearchReference/Commontimeformatvariables

In your case you want something like %Y-%m-%d-%H.%M.%S.%6N.

View solution in original post

Ayn
Legend

A reference on variables you can use when parsing timestamps with strptime can be found in the docs here: http://docs.splunk.com/Documentation/Splunk/6.6.3/SearchReference/Commontimeformatvariables

In your case you want something like %Y-%m-%d-%H.%M.%S.%6N.

CarmineCalo
Path Finder

Tks, it works!
Now I got how to use strptime.

Tks Again,
Carmine

0 Karma

MuS
SplunkTrust
SplunkTrust

Welcome back @Ayn ! It's been a long time 😉

cheers, MuS

PS: you should sign up for slack as well http://docs.splunk.com/Documentation/Community/1.0/community/Chat

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...