Splunk Search

How to calculate duration?

edwinmae
Path Finder

Hi,

I try to calculate the duration

I have extracted 2 fields, start_time and end_time

edwinmae_0-1654257470004.png

--

I believe both times should be in the exact same format in order to successful calculate the duration

start_time = 2022-06-03T02_11_50

end_time = 2022-06-03T03:48:06

--

I have been puzzling for some time now, but how do I get the start_time in the same format as the end_time? ...

Thanks for help in advance!

Edwin

 

 

 

 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")

View solution in original post

0 Karma

edwinmae
Path Finder

That actually worked 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...