Splunk Search

How to find event timestamp duration with respect to current time in minute and seconds?

Abhineet
Loves-to-Learn Everything

We have splunk event having field "eventdateTime"  in format mentioned below.

for example

eventdateTime

2023-04-17 06:45:55,405
2023-04-17 06:45:52,599
2023-04-17 06:45:52,446
2023-04-17 06:45:52,208

 

We want to create new field "duration" that will give difference of "eventdateTime" value with current date time value in Minute seconds format i.e( duration = 4Min:10.256Sec)

For Example:

 eventdateTime = 22023-04-17 06:51:19,950

current date time = 2023-04-17 06:53:39,000

duration = 2Min:19.050Sec

Tags (1)
0 Karma

woodcock
Esteemed Legend

| eval duration=now()-strptime(eventdateTime,"%F %T,%3N")
| fieldformat duration=tostring(duration ,"duration")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| eval duration=tostring(now()-strptime(eventdateTime,"%F %T,%3N"),"duration")

 

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...