Splunk Search

How to assign the 2 start_time and stop_time of one event into _time field ?

Jouman
Path Finder

Hi all,

I have an table with the start time and stop time in each case as below.

IDCase NameStart TimeStop Time
user_1Case_A2023.08.10 13:26:37.8677872023.08.10 13:29:42.159543
user_2Case_B2023.08.10 13:29:42.1595452023.08.10 13:29:48.202143

 

Because I want to merge the duration of case execution with another event, I hope to transfer the above table into this kind of table.

_timeIDCase Namecase_action
2023.08.10 13:26:37.867787user_1Case_Astart
2023.08.10 13:29:42.159543user_1Case_Astop
2023.08.10 13:29:42.159545user_2Case_Bstart
2023.08.10 13:29:48.202143user_2Case_Bstop

 

I could transfer the start time into _time by 

 

|eval _time='Start Time'

 

However, I can't think of a solution to record "Stop Time" into _time as well.

Does any one have a idea about how to accomplish this?

 

Thanks a lot.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval time=mvappend('Start Time', 'Stop Time')
| mvexpand time
| eval _time=time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval time=mvappend('Start Time', 'Stop Time')
| mvexpand time
| eval _time=time
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...