Splunk Search

How to calculate the time difference in minutes between two events?

msachdeva3
Explorer

I have two events

I'm using this

nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time|

start date or vendor notified time looks like this : 2016-10-21 18:59:00
I want to see results difference in minutes??

0 Karma
1 Solution

cmerriman
Super Champion

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming you're not getting your latency field populated here, are both VENDOR_NOTIFIED_TIME and START_DATE field appear in separate events? If yes, then you would need to join those two events using some common field.

0 Karma

cmerriman
Super Champion

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time
0 Karma

msachdeva3
Explorer

convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y/%m/%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y/%m/%d %H:%M:%S"|

tried displaying results with table command
|table nt_time st_time |head 5

these fields are empty i.e not working
unable to convert time i guess

0 Karma

cmerriman
Super Champion

what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?

I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...