Splunk Search

How to calculate the time difference in minutes between two events?

Explorer

I have two events

I'm using this

nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time|

start date or vendor notified time looks like this : 2016-10-21 18:59:00
I want to see results difference in minutes??

0 Karma
1 Solution

Super Champion

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Assuming you're not getting your latency field populated here, are both VENDORNOTIFIEDTIME and START_DATE field appear in separate events? If yes, then you would need to join those two events using some common field.

0 Karma

Super Champion

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time

View solution in original post

0 Karma

Explorer

convert mktime(VENDORNOTIFIEDTIME) as nttime timeformat="%Y/%m/%d %H:%M:%S"|convert mktime(STARTDATE) as st_time timeformat="%Y/%m/%d %H:%M:%S"|

tried displaying results with table command
|table nttime sttime |head 5

these fields are empty i.e not working
unable to convert time i guess

0 Karma

Super Champion

what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?

I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.

0 Karma