Splunk Search

How to calculate duration?

edwinmae
Path Finder

Hi,

I try to calculate the duration

I have extracted 2 fields, start_time and end_time

edwinmae_0-1654257470004.png

--

I believe both times should be in the exact same format in order to successful calculate the duration

start_time = 2022-06-03T02_11_50

end_time = 2022-06-03T03:48:06

--

I have been puzzling for some time now, but how do I get the start_time in the same format as the end_time? ...

Thanks for help in advance!

Edwin

 

 

 

 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")

View solution in original post

0 Karma

edwinmae
Path Finder

That actually worked 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...