Splunk Search

How to edit my search to calculate the difference between two timestamps in the same event?

pkurt
Path Finder

Hello,

I am trying to determine the time difference between the two timeStamp columns in my events.
I tried to use the search below, but cannot return anything for the "diff" at the end...

 ... my base search ... | eval raw_time=strptime(_time,'%Y-%m-%dT%H:%M:%S')  | eval utc_endtime=strptime(UTC_EndTime,'%Y-%m-%dT%H:%M:%S') | eval diff= raw_time-utc_endtime

My example events are like this:

2016-10-15T03:59:59.999999, UTC_EndTime=2016-10-14T19:59:59.999999,
2016-10-15T02:59:59.999999, UTC_EndTime=2016-10-14T18:59:59.999999,
2016-10-15T01:59:59.999999, UTC_EndTime=2016-10-14T17:59:59.999999,

I would appreciate if you can help me to see the mistake I am doing here.

Many thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.

  ... my base search ...   | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime

View solution in original post

0 Karma

somesoni2
Revered Legend

The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.

  ... my base search ...   | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime

View solution in original post

0 Karma

pkurt
Path Finder

it worked, thank you very much!

0 Karma

cmerriman
Super Champion

Use convert.

  ... my base search ... | Convert mktime(_time) as raw_time timestamp="%Y-%m-%dT%H:%M:%S" | Convert mktime(UTC_EndTime) as utc_endtime "%Y-%m-%dT%H:%M:%S"| eval diff= raw_time-utc_endtime
0 Karma

pkurt
Path Finder

I could not make this work. Thank you very much though!

0 Karma

sundareshr
Legend

Change single quotes ' to double quotes "

| eval raw_time=strptime(_time,"%Y-%m-%dT%H:%M:%S")  | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S") | eval diff= raw_time-utc_endtime
0 Karma

pkurt
Path Finder

Thank you very much. Double quotes are not the issue. It works only if I add ".%N" to my time string since the actual timeStamp has ".999999" component.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!