Splunk Search

How to subtract two specific requestTime

Path Finder

For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T08:43:15" when pageSubmitted="/snapcCustomer.xhtml" from requestTime="2009-05-26T08:47:23" when pageSubmitted="/snapcPremium.xhtml" 08:47:23 - 08:43:15 = 4:12 (4 minutes and 12 seconds) This the value I want to compute. How can I achieve this?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

convert dur2sec works well for this one:

<search_terms> | convert dur2sec(requestTime) as reqTimeConverted | convert dur2sec(responseTime) as respTimeConverted | eval duration=respTimeConverted-reqTimeConverted

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

convert dur2sec works well for this one:

<search_terms> | convert dur2sec(requestTime) as reqTimeConverted | convert dur2sec(responseTime) as respTimeConverted | eval duration=respTimeConverted-reqTimeConverted

View solution in original post

0 Karma