Splunk Search

How to convert epoch to H:M:S?

auaave
Communicator

Hi Guys,

I have the below time formats that I converted to epoch to get the difference.
START - "04-30-2018 16:17:09"
END - "2018-04-30 16:17:19.072"

I used the below query but the difference/ duration doesn't display properly. It displays 10:00:10 instead of 00:00:10, 10:10:10 instead of 00:10:10. How can I fix this? Thanks!

| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=strftime(DURATION, "%H:%M:%S")

0 Karma
1 Solution

p_gurav
Champion

Can you try :

| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=tostring(DURATION, "duration")

View solution in original post

xpac
SplunkTrust
SplunkTrust

Hey,

try this:

| makeresults 
| eval START="04-30-2018 16:17:09"
| eval END="2018-04-30 16:17:19.072" 
| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") 
| eval start=strptime(START,"%m-%d-%Y %H:%M:%S") 
| eval DURATION=(end-start) 
| table start end DURATION
| fieldformat DURATION=tostring(DURATION, "duration")
| eval DURATION=replace(DURATION, "\.000000", "")

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

auaave
Communicator

thanks @xpac! This work for me as well but I didn't use the |make results 🙂

0 Karma

xpac
SplunkTrust
SplunkTrust

The makeresults part is only used to create fake events because we don't have your data available 😉
Happy it worked out for you 🙂

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should do the DURATION math before converting to string format time.

|eval DURATION=('end'-'start') 
| eval DURATION=strftime(DURATION, "%H:%M:%S")
|table start end DURATION 
0 Karma

auaave
Communicator

Thanks @skoelpin, I tried this but still got the 10: in front. 😞

0 Karma

p_gurav
Champion

Can you try :

| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=tostring(DURATION, "duration")

auaave
Communicator

Thank you @ p_gurav! This works for me 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...