Splunk Search

Help with dur2sec function not displaying

New Member

Hi
I am having an issue with the result of my dur2sec function not displaying.
Here is the SPL. I am still new to splunk so have put what I believe I am doing alongside the query.

|eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") -- convert the ENTRY field date string to a proper date format
|eval dwellTimeS = tostring(now()-Entrytimestamp,"duration") -- get the duration string and assign it to variable dwellTimeS
|convert dur2sec(dwellTimeS) AS dwellTimeC -- convert the dwellTime string variable to seconds and assign to dwellTime_C variable

When i then use the dwellTime_C in a table the column is blank. Please can anyone help and advise where I am going wrong ?

Many Thanks

PS: I am not in the office tomorrow so wont be able to reply immediately.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Why not skip the middle step? now()-Entrytimestamp is in seconds so there's no need to convert.

| eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S")
| eval dwellTime_C = now()-Entrytimestamp
| eval dwellTime_S = tostring(dwellTime_C, "duration")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Why not skip the middle step? now()-Entrytimestamp is in seconds so there's no need to convert.

| eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S")
| eval dwellTime_C = now()-Entrytimestamp
| eval dwellTime_S = tostring(dwellTime_C, "duration")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thanks Rich

0 Karma