Splunk Search

Find the diff between two times

luckyman80
Path Finder

Hi I am really struggling to find the difference between the 51= time and the 59= time below and add to a separate column

My log extract example is 

2021-01-06 12:37:57.411 [FIDO1] INFO LogAuditor - [FIDO2] Outgoing [12294][0] : 8=FIX.4.49=54135=D49=FIDO156=FIDO2_192_168_0_134=1599251=20210106-17:37:57.41011=1609686062170-FIDO15140WTZ00087815=USD21=138=100000040=244=19.632154=255=PECEOF59=359=20210106-17:37:57.409

Thanks in advance experts 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Sorry about that.   There were some typos in my answer.  I've fixed them.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

luckyman80
Path Finder

i actually noticed there is an issue with the strp time as there is no results given when i table the diff and epoch51/epoch59 items 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry about that.   There were some typos in my answer.  I've fixed them.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

First, we need to extract the fields.  Then we convert the timestamps into epoch form.  Finally, we can compute the difference.

 

<your search>
| rex "51=(?<ts51>\d{8}-\d\d:\d\d:\d\d\.\d{3})"
| rex "59=(?<ts59>\d{8}-\d\d:\d\d:\d\d\.\d{3})"
| eval epoch51=strptime(ts51,"%Y%m%d-%H:%M:%S.%3N"), epoch59=strptime(ts59,"%Y%m%d-%H:%M:%S.%3N")
| eval diff=epoch59 - epoch51

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

luckyman80
Path Finder

hi thanks for this. I still am unable to see the def in a separate column. Whats the best way of displaying the results for the diff ? in a table ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...