Splunk Search

Help with dur2sec function not displaying

PBerry7538
New Member

Hi
I am having an issue with the result of my dur2sec function not displaying.
Here is the SPL. I am still new to splunk so have put what I believe I am doing alongside the query.

|eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") -- convert the ENTRY field date string to a proper date format
|eval dwellTime_S = tostring(now()-Entrytimestamp,"duration") -- get the duration string and assign it to variable dwellTime_S
|convert dur2sec(dwellTime_S) AS dwellTime_C -- convert the dwellTime string variable to seconds and assign to dwellTime_C variable

When i then use the dwellTime_C in a table the column is blank. Please can anyone help and advise where I am going wrong ?

Many Thanks

PS: I am not in the office tomorrow so wont be able to reply immediately.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Why not skip the middle step? now()-Entrytimestamp is in seconds so there's no need to convert.

| eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S")
| eval dwellTime_C = now()-Entrytimestamp
| eval dwellTime_S = tostring(dwellTime_C, "duration")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not skip the middle step? now()-Entrytimestamp is in seconds so there's no need to convert.

| eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S")
| eval dwellTime_C = now()-Entrytimestamp
| eval dwellTime_S = tostring(dwellTime_C, "duration")
---
If this reply helps you, Karma would be appreciated.
0 Karma

PBerry7538
New Member

Thanks Rich

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...