Splunk Search

How to calculate duration?

edwinmae
Path Finder

Hi,

I try to calculate the duration

I have extracted 2 fields, start_time and end_time

edwinmae_0-1654257470004.png

--

I believe both times should be in the exact same format in order to successful calculate the duration

start_time = 2022-06-03T02_11_50

end_time = 2022-06-03T03:48:06

--

I have been puzzling for some time now, but how do I get the start_time in the same format as the end_time? ...

Thanks for help in advance!

Edwin

 

 

 

 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")

View solution in original post

0 Karma

edwinmae
Path Finder

That actually worked 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Developer Spotlight with Eduard Lekanne

From Network Engineer to Building Agentic AI for Splunk Eduard Lekanne has been architecting technology ...

From Data Landing to Insight

Search Across More of Your Data Ecosystem The data you need may live in Splunk, high-volume machine data, ...