Splunk Search

How to correct the time in the "elapsed_Time" field?

saurabhbdwj
Engager

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time= action_EndTime - action_StartTime
| convert ctime(action_StartTime) ctime(action_EndTime) ctime(elapsed_Time)
| fields + action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

saurabhbdwj_0-1654146434889.png

The elapsed_Time is wrong, how can i make it correct?

Labels (3)
0 Karma
1 Solution

gcusello
Legend

Hi @saurabhbdwj,

elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime) 
| table action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @saurabhbdwj,

elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime) 
| table action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

Ciao.

Giuseppe

saurabhbdwj
Engager

Hi @gcusello 
This works exactly the way i want. Thank you for you help.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...