Splunk Search

Elapsed time

david_fresne
New Member

How to get elapsed time? I have the following
|eval tnow = now() |convert ctime(tnow) as currtime | eval el_time =(currtime-rtime) | table ServName rtime currtime el_time
Thanks

Tags (3)
0 Karma

mw
Splunk Employee
Splunk Employee

What output are you getting? You may need to run a convert on rtime if you're not already, but something like this should work:

... | eval now = now() | eval tdelta = now - rtime | table ...
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...