Splunk Search

How to create a beautified time difference?

Motivator

We have the following code:

| stats count min(_time) as min, max(_time) as max by src, ....
| eval delta = (max - min)/(60*60*24)

How can we present this delta field as, let's say - 3 days, 2 hours, 16 minutes ?... or any other human readable way.

Path Finder

this answer is wrong. you are trying to strftime from milliseconds. although the result will show readable format, the values are invalid.

0 Karma

Builder

Hi danielbb, try: | makeresults | eval mintime=1570466331.984 | eval maxtime=32890568331.784 | eval stime= round(maxtime-mintime,0) | eval timestr=strftime(stime,"%j days, %H hours, %M minutes, %S seconds")

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!