Splunk Search

How to get the time difference of two timestamp in minutes?

mikeyty07
Communicator

I 've  two fields one is _time and another one is received_time.  I want to get the time differences between these two timestamp.  

Logs look like 
2023-07-11 11:19:24.964 ..... received_time= 1688574223791

I converted the epoch to human readable but i couldnt get the time differences  between these two timestamp.

my search:

<query> | rex "received_time\"\:(?<recTime>[^\,]+)" | eval recTime = strftime(recTime/1000, "%Y-%m-%d %H:%M:%S.%3N")
| eval diff = recTime - _time 
| table recTime _time  diff

but it doesnt show any data on diff. Am I missing something?

 

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mikeyty07,

yes, it's possible, please try this:

<your_search> 
| rex "received_time\"\:(?<recTime>[^\,]+)" 
| eval diff = recTime - _time 
| eval recTime = strftime(recTime/1000, "%Y-%m-%d %H:%M:%S.%3N")
| eval diff=tostring(diff,"duration")
| table recTime _time  diff

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

If you extract your recTime as a string from the raw event you have to either parse it into a numerical timestamp with strptime() or at least (if it's already in epoch) cast it to integer by using tonumber().

EDIT: OK. I just noticed that in your raw data timestamp is already numerical. So you need to do

| eval diff = tonum(recTime)/1000 - _time

Also - when you're manipulating time, it's often more convenient to use fieldformat instead of eval to produce human-readable time strings. But if you insist on rendering timestamp to string with eval, do it after you calculate the diff part.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mikeyty07 

you can calculate diff before tranforming timestamps from epoch to human readable.

<your_search> 
| rex "received_time\"\:(?<recTime>[^\,]+)" 
| eval diff = recTime - _time 
| eval recTime = strftime(recTime/1000, "%Y-%m-%d %H:%M:%S.%3N")
| table recTime _time  diff

Ciao.

Giuseppe

0 Karma

mikeyty07
Communicator
_timerecTimediff
2023-07-11 11:12:44.8882023-07-11 11:15:55.9990 00:03:11.111


the diff is coming in numerical can it be done like this table? 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Sure. Since _time is being internally stored as a number of seconds, all arithmetics involving this number will yield number of seconds. There are several functions allowing you to convert it to more human-friendly format.

Of course you could calculate it manually, but you can use - as @gcusello already showed - the convert() function. I would however use fieldformat instead of eval to keep the value internally as a number (which makes it easier to do subsequent manipulations if you need it or sorting).

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mikeyty07,

yes, it's possible, please try this:

<your_search> 
| rex "received_time\"\:(?<recTime>[^\,]+)" 
| eval diff = recTime - _time 
| eval recTime = strftime(recTime/1000, "%Y-%m-%d %H:%M:%S.%3N")
| eval diff=tostring(diff,"duration")
| table recTime _time  diff

Ciao.

Giuseppe

mikeyty07
Communicator

this gave me the idea to change time to numeric and from there strftime and do calculate the time diff

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mikeyty07 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...