Splunk Search

Eval Time_Diff

cglowjr
New Member

I am having trouble getting a result to appear for the below query. I am trying to produce a column showing time_diff of the lastest timestamp result for lane_RFID subtracted from the time now. The table doesn't show a result for time_diff, but everything else shows properly. Hopefully it is something easy. Thank you.

index=*"RFID Message received for:" | stats latest(date_time) by LANE_RFID | eval time_now=now() | eval time_now=strftime(time_now,"%Y/%m/%d %H:%M:%S") | eval time_diff=strftime(time_diff,"%M:%S") | eval time_diff=time_now-date_time| table LANE_RFID time_now latest(date_time) time_diff

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=*"RFID Message received for:" 
| stats latest(date_time) as  date_time by LANE_RFID 
| eval time_now=strftime(now(),"%Y/%m/%d %H:%M:%S")
| eval time_diff=now() - strptime(date_time,"%Y/%m/%d %H:%M:%S") 
| table LANE_RFID time_now date_time time_diff

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=*"RFID Message received for:" 
| stats latest(date_time) as  date_time by LANE_RFID 
| eval time_now=strftime(now(),"%Y/%m/%d %H:%M:%S")
| eval time_diff=now() - strptime(date_time,"%Y/%m/%d %H:%M:%S") 
| table LANE_RFID time_now date_time time_diff
0 Karma

cglowjr
New Member

This works wonderfully! Thank you so much!

0 Karma

to4kawa
Ultra Champion

Is date_time epoch?

0 Karma

cglowjr
New Member

date_time is formatted 2020/02/24 16:14:34

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...