Splunk Search

How to calculate the time difference in minutes between two events?

msachdeva3
Explorer

I have two events

I'm using this

nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time|

start date or vendor notified time looks like this : 2016-10-21 18:59:00
I want to see results difference in minutes??

0 Karma
1 Solution

cmerriman
Super Champion

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming you're not getting your latency field populated here, are both VENDOR_NOTIFIED_TIME and START_DATE field appear in separate events? If yes, then you would need to join those two events using some common field.

0 Karma

cmerriman
Super Champion

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time
0 Karma

msachdeva3
Explorer

convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y/%m/%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y/%m/%d %H:%M:%S"|

tried displaying results with table command
|table nt_time st_time |head 5

these fields are empty i.e not working
unable to convert time i guess

0 Karma

cmerriman
Super Champion

what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?

I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...