Splunk Search

How to find event timestamp duration with respect to current time in minute and seconds?

Abhineet
Loves-to-Learn Everything

We have splunk event having field "eventdateTime"  in format mentioned below.

for example

eventdateTime

2023-04-17 06:45:55,405
2023-04-17 06:45:52,599
2023-04-17 06:45:52,446
2023-04-17 06:45:52,208

 

We want to create new field "duration" that will give difference of "eventdateTime" value with current date time value in Minute seconds format i.e( duration = 4Min:10.256Sec)

For Example:

 eventdateTime = 22023-04-17 06:51:19,950

current date time = 2023-04-17 06:53:39,000

duration = 2Min:19.050Sec

Tags (1)
0 Karma

woodcock
Esteemed Legend

| eval duration=now()-strptime(eventdateTime,"%F %T,%3N")
| fieldformat duration=tostring(duration ,"duration")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| eval duration=tostring(now()-strptime(eventdateTime,"%F %T,%3N"),"duration")

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...