Splunk Search

How do I convert year, month, day, hour, minute, seconds to seconds?

WXY
Path Finder

Now, I want to get the time interval

For example:

between 2018/5/31 8:25:45 and 2018/5/31 8:25:47 ,the time interval is 2s

What should I do?

alt text

Tags (3)
0 Karma

niketn
Legend

[UPDATED]

If the requirement is to convert seconds to Days Hour Minute Second format tostring() evaluation conversion function can be used.


@WXY, please try the following run anywhere search which generates one sample event with fields StartTime and EndTime ( |makeresults till eval StartTime="2018/5/31 8:25:45"... generates dummy Date values as per the question).

| makeresults
| fields - _time
| eval StartTime="2018/5/31 8:25:45", EndTime="2018/5/31 8:25:47"
| eval StartTime=strptime(StartTime,"%Y/%m/%d %H:%M:%S"),EndTime=strptime(EndTime,"%Y/%m/%d %H:%M:%S")
| eval duration=EndTime-StartTime
| fieldformat StartTime=strftime(StartTime,"%Y/%m/%d %H:%M:%S")
| fieldformat EndTime=strftime(EndTime,"%Y/%m/%d %H:%M:%S")

Pipe the following after | eval duration to convert to Days+ HH:MM:SS format:

 | eval durationString=tostring(duration,"duration")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...