Eval difference between two fields for each entry

[ltrand]

So I'm trying to display what the timespan is from start to finish of a bucket and add it as a new field to the table.

|dbinspect index=main
| eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S") | eval span=tostring((end_time-start_time), "duration")
| table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount

The problem is that the eval statement that is supposed to calculate span is not functioning correctly, it is just empty for each line. Any thoughts on how I can fix this?

[richgalloway · Accepted solution]

Subtract times using epochs rather than strings. Then convert it into a human-readable format, if desired.

... | eval span=endEpoch-startEpoch | ...

[ltrand]

Thanks, that got me there.


|dbinspect index=main
| eval span=tostring((endEpoch-startEpoch), "duration") | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S")
| table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount,splunk_server,path