Splunk Search

Find time differences between two extracted fields in the format HH:MM:SS

krussell101
Path Finder

I have two fields in a single search row. start_time and end_time. they are both in the format HH:MM:SS. I'd like to calculate the duration end_time - start_time and have the results in the same format HH:MM:SS.

thanks!

Tags (1)

kristian_kolb
Ultra Champion

To get the duration in the new field dur;

...| eval st=strptime(start_time, "%H:%M:%S") | eval et=strptime(end_time,"%H:%M:%S") | eval diff = et - st | eval dur = tostring(diff, "duration")

Read more on eval functions here;

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/k

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...