Splunk Search

How to correct the time in the "elapsed_Time" field?

saurabhbdwj
Engager

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time= action_EndTime - action_StartTime
| convert ctime(action_StartTime) ctime(action_EndTime) ctime(elapsed_Time)
| fields + action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

saurabhbdwj_0-1654146434889.png

The elapsed_Time is wrong, how can i make it correct?

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @saurabhbdwj,

elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime) 
| table action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @saurabhbdwj,

elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:

index="SOMETHING"  earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime) 
| table action_StartTime action_EndTime elapsed_Time 
| sort by action_StartTime

Ciao.

Giuseppe

saurabhbdwj
Engager

Hi @gcusello 
This works exactly the way i want. Thank you for you help.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...