Splunk Search

How to convert the 24hrs time to 12hrs time and show the difference in -ve sign indication?

srujana96
Explorer

i have the 2 values let's say
expected time= 6:00:00
completion time= 08:32:44
and the expected output should be the difference of the above i.e (expected-completion) in 12 hrs format including negative sign for example : output= -2:32:44 (which is the diff between expected and completion)

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Convert both times to epoch times (if they aren't already) using strptime()

Then subtract one from the other as diff (for example).

Then use tostring to display as hours:minutes:seconds

| eval x=if(diff<0,"-","").tostring(abs(diff),"duration")

srujana96
Explorer

Thanks @ITWhisperer  it worked!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...