Splunk Search

How to correct the time in the "elapsed_Time" field?

saurabhbdwj
Engager

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time= action_EndTime - action_StartTime
| convert ctime(action_StartTime) ctime(action_EndTime) ctime(elapsed_Time)
| fields + action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

saurabhbdwj_0-1654146434889.png

The elapsed_Time is wrong, how can i make it correct?

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @saurabhbdwj,

elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime) 
| table action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @saurabhbdwj,

elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime) 
| table action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

Ciao.

Giuseppe

saurabhbdwj
Engager

Hi @gcusello 
This works exactly the way i want. Thank you for you help.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...