Splunk Search

How to find ELAPSED Time entries greater than a particular amount.

umithchada
Explorer

Hello,

 

I am trying to find the list of elapsed time over a specific time using our os process sourcetype.

Looks something like this

index=os sourcetype=ps host=* COMMAND=*
| where ELAPSED > "12:59:59"
| table COMMAND ELAPSED _time 

But for some reason, the ELAPSED time is still displaying values under this time.

 

If the ELAPSED Time goes over a day, I am able to filter that out with the where command.

Example: 

| where ELAPSED > "60-12:59:59"
| table COMMAND ELAPSED _time

-> Output will give me the results which are older than 60 days, 12:59:59 hours.

Labels (1)
0 Karma
1 Solution

johnhuang
Motivator

Convert elapsed time into seconds and then filter.

| rex field=ELAPSED "((?<dd>\d+)\-?)((?<hh>\d+)\:?)((?<mm>\d+)\:)?(?<ss>\d+)$"
| eval elapsed_secs=(dd * 86400) + (hh * 3600) + (mm * 60) + (ss)
| where elapsed_secs>46799

 

View solution in original post

0 Karma

johnhuang
Motivator

Convert elapsed time into seconds and then filter.

| rex field=ELAPSED "((?<dd>\d+)\-?)((?<hh>\d+)\:?)((?<mm>\d+)\:)?(?<ss>\d+)$"
| eval elapsed_secs=(dd * 86400) + (hh * 3600) + (mm * 60) + (ss)
| where elapsed_secs>46799

 

0 Karma

umithchada
Explorer

Thanks, this worked for me, 

Looks like for data sets below 1 day, we will have to convert to seconds to get accurate filtering.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you have ELAPSED_Time as a value in seconds rather than a string?

0 Karma

umithchada
Explorer

The value was of ELAPSED was like "05:00:00" .

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...