Splunk Search

How to convert results of Eval Function

matthew_ramsey
Explorer

Hello, Looking for some help with my search.
The convert works fine for Last and First Occurrence but not sure why not for the two eval commands? The two eval commands bring me back seconds I think? example 17778.566205 or is that EPOC? I need to convert them to days/hours/mins and I've tried several things but not having any luck.

index=ABC MessageText="Kickout"

|stats max(_time) as LastOccurence min(_time) as FirstOccurence by MessageText
|eval "Duration Between Events"=LastOccurance-FirstOccurence
|eval "Time Since Last Event"=(now()-LastOccurence)

|convert timeformat="%m/%d/%Y %H:%M:%S" ctime("FirstOccurence")
|convert timeformat="%m/%d/%Y %H:%M:%S" ctime("LastOccurence")
|table FirstOccurence, LastOccurence, "Duration Between Events", "Time Since Last Event"

1 Solution

cmerriman
Super Champion

from the looks of it, "Duration Between Events" and "Time Since Last Event" should be in seconds because you'd be subtracting two epoch values. if you want them in days:hours:mins, try this:

|eval "Duration Between Events"=tostring(LastOccurance-FirstOccurence,"duration")
|eval "Time Since Last Event"=tostring((now()-LastOccurence),"duration")

http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConversionFunctions#tostring.28X.2...

View solution in original post

cmerriman
Super Champion

from the looks of it, "Duration Between Events" and "Time Since Last Event" should be in seconds because you'd be subtracting two epoch values. if you want them in days:hours:mins, try this:

|eval "Duration Between Events"=tostring(LastOccurance-FirstOccurence,"duration")
|eval "Time Since Last Event"=tostring((now()-LastOccurence),"duration")

http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConversionFunctions#tostring.28X.2...

Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...