Splunk Search

How do you calculate the time in minutes since the latest event, using a manual time entered as a field, not the timestamp?

ltemple1
Engager

Samples are collected and later manually entered into Splunk. I am interested in the time the sample was tested, not when it was uploaded into Splunk. There is a field called Manual Time with the format in "%H:%M:%S %p".

I wrote a search based on other answers that can work using the _time field but it does not seem to work for the ManualTime field.

The following code results in having a ManualTime and nowstring time listed in the same time format.

index="index" sourcetype="sourcetype" 
| stats latest(ManualTime) as ManualTime
| eval timenow=now() 
| eval nowstring=strftime(now(), "%H:%M:%S %p")

Once I add the following code it breaks.

| eval diff = tostring((now() - ManualTime), "duration") 
| table diff

I also need the result to be in the units of minutes (i.e. 75 minutes not 1:15)

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If ManualTime is in string format () then it must be converted to epoch form before you can do any math with it. Try this.

index=index sourcetype=sourcetype
| stats latest(ManualTime) as ManualTime
| eval timenow=now() 
| eval nowstring=strftime(now(), "%H:%M:%S %p") 
| eval eManualTime=strptime(ManualTime,"%H:%M:%S %p") 
| eval diff=round((now()-eManualTime)/60,0)
| table diff
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If ManualTime is in string format () then it must be converted to epoch form before you can do any math with it. Try this.

index=index sourcetype=sourcetype
| stats latest(ManualTime) as ManualTime
| eval timenow=now() 
| eval nowstring=strftime(now(), "%H:%M:%S %p") 
| eval eManualTime=strptime(ManualTime,"%H:%M:%S %p") 
| eval diff=round((now()-eManualTime)/60,0)
| table diff
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...