Splunk Search

Eval difference between two fields for each entry

ltrand
Contributor

So I'm trying to display what the timespan is from start to finish of a bucket and add it as a new field to the table.

|dbinspect index=main
| eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S") | eval span=tostring((end_time-start_time), "duration")
| table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount

The problem is that the eval statement that is supposed to calculate span is not functioning correctly, it is just empty for each line. Any thoughts on how I can fix this?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Subtract times using epochs rather than strings. Then convert it into a human-readable format, if desired.

... | eval span=endEpoch-startEpoch | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Subtract times using epochs rather than strings. Then convert it into a human-readable format, if desired.

... | eval span=endEpoch-startEpoch | ...
---
If this reply helps you, Karma would be appreciated.

ltrand
Contributor

Thanks, that got me there.


|dbinspect index=main
| eval span=tostring((endEpoch-startEpoch), "duration") | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S")
| table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount,splunk_server,path

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...