Splunk Search

How to get the time difference after converting unix time using strftime?

payton_tayvion
Path Finder

I'm currently trying to get the duration of some events, but when i use this search nothing is coming back:

| tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature
| eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S")
| fields - first,last
|eval duration=last_time-first_time

The strftime command converts the unix time, but im not able to get the difference

0 Karma

adonio
Ultra Champion

maybe change the order:

| tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature 
| eval duration=last - first
| eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S") 
| fields - first,last duration
0 Karma

payton_tayvion
Path Finder

when i do it that way and convert the duration, the results are dates thats in 1970s vs it actually being the duration of the first and last time.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...