Splunk Search

How to find event timestamp duration with respect to current time in minute and seconds?

Abhineet
Loves-to-Learn Everything

We have splunk event having field "eventdateTime"  in format mentioned below.

for example

eventdateTime

2023-04-17 06:45:55,405
2023-04-17 06:45:52,599
2023-04-17 06:45:52,446
2023-04-17 06:45:52,208

 

We want to create new field "duration" that will give difference of "eventdateTime" value with current date time value in Minute seconds format i.e( duration = 4Min:10.256Sec)

For Example:

 eventdateTime = 22023-04-17 06:51:19,950

current date time = 2023-04-17 06:53:39,000

duration = 2Min:19.050Sec

Tags (1)
0 Karma

woodcock
Esteemed Legend

| eval duration=now()-strptime(eventdateTime,"%F %T,%3N")
| fieldformat duration=tostring(duration ,"duration")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| eval duration=tostring(now()-strptime(eventdateTime,"%F %T,%3N"),"duration")

 

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...