Splunk Search

How to calculate duration?

edwinmae
Path Finder

Hi,

I try to calculate the duration

I have extracted 2 fields, start_time and end_time

edwinmae_0-1654257470004.png

--

I believe both times should be in the exact same format in order to successful calculate the duration

start_time = 2022-06-03T02_11_50

end_time = 2022-06-03T03:48:06

--

I have been puzzling for some time now, but how do I get the start_time in the same format as the end_time? ...

Thanks for help in advance!

Edwin

 

 

 

 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")

View solution in original post

0 Karma

edwinmae
Path Finder

That actually worked 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Both need to be in epoch format to do calculations such as difference on

| eval start_time = strptime(start_time,"%Y-%m-%dT%H_%M_%S")
| eval end_time = strptime(end_time,"%Y-%m-%dT%H:%M:%S")
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...