Find the duration between two events

[luna]

Hello,

I need to find the duration between two events. I went over the solutions on Splunk, but still can't get the calculation. Both sentToSave and SaveDoc have the time stamp already formatted that is why I used the case function. I am able to see the fields populate with their time stamps, but I am not able to get the Duration field to populate the duration - it simply does not populate at all. Need some help on how to get the Duration - any advise? Below is my query

(index=souce1 dept=qvc  event="sentToSave"  ) OR (index=source dept=save area=saveDoc)

 

| eval saveDocTime=case(area="saveDoc", TimeStamp),

sentToSaveTime=case(event="sentToSave", TimeStamp)

| eval Duration=saveDocTime-sentToSaveTime

| stats values(Duration) as Duration earliest(sentToSaveTime) as sentToSaveTime latest(saveDocTime) as saveDocTime  by emailRequest

| where isNotNull(sentToSaveTime) AND isNotNull(saveDocTime)

[luna]

I also needed to have turned the times I was subtracting to epoch. I used strptime to subtract the times then I was able to get duration.

[scelikok]

Hi @luna,

Since saveDocTime and sentToSaveTime fields are not in the same event, Duration cannot be calculated. Please try below;

(index=souce1 dept=qvc event="sentToSave" ) OR (index=source dept=save area=saveDoc) 
| eval saveDocTime=case(area="saveDoc", TimeStamp), sentToSaveTime=case(event="sentToSave", TimeStamp) 
| stats earliest(sentToSaveTime) as sentToSaveTime latest(saveDocTime) as saveDocTime by emailRequest 
| eval Duration=saveDocTime-sentToSaveTime 
| where isNotNull(sentToSaveTime) AND isNotNull(saveDocTime)