Splunk Search

How to get the time difference after converting unix time using strftime?

payton_tayvion
Path Finder

I'm currently trying to get the duration of some events, but when i use this search nothing is coming back:

| tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature
| eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S")
| fields - first,last
|eval duration=last_time-first_time

The strftime command converts the unix time, but im not able to get the difference

0 Karma

adonio
Ultra Champion

maybe change the order:

| tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature 
| eval duration=last - first
| eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S") 
| fields - first,last duration
0 Karma

payton_tayvion
Path Finder

when i do it that way and convert the duration, the results are dates thats in 1970s vs it actually being the duration of the first and last time.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...