How do I find the difference in time between two fields in the same event?

[LHisham]

I am fairly new to Splunk so bear with me.

I have extracted two fields and they are ConnectTime and DisconnectTime and are consecutive in my event in that order. I want to find the difference in time between the values in both those fields. Not only that but I want to find the difference in time between both fields in all my events, I then want to create an alert that will notify me when the difference in time between ConnectTime and DisconnectTime is less than 2 seconds.

I am aware that the command I need to use is the "delta" command. I have visited the Splunk Knowledge Page for instructions on how to use the delta command but when I type in "| delta DisconnectTime p=1" I do not get anything in my statistics tab.

Thanks in advance

[ryhluc01]

Hello : ) can you select @justinatpnnl 's answer?

[justinatpnnl]

If I understand your question correctly, both of these fields are in the same event, so 'Delta' is not the right option for you here. You should be able to use a simple Eval to create a new field in each event:

| eval TimeDifference = DisconnectTime - ConnectTime

Then you can add a simple WHERE statement to limit your events to the ones under two seconds:

| WHERE TimeDifference < 2

This will require that your ConnectTime and DisconnetTime be in epoch format, but if they are simple date strings your can convert them to epoch using strptime().

[sundareshr]

delta command will work only on the same field in both events. In your example since one field is called ConnectedTime and the other DisconnectedTime, one way would be to do something like this ... ConnectedTime=* OR DisconnectTime=* | eval eventtime=coalesce(ConnectedTime , DisconnectedTime) | delta eventtime as timediff p=1

This should give you time difference in seconds. You can then format the time using .. | fieldformat timediff=tostring(timediff, "duration")