Splunk Search

How to subtract two specific requestTime

Path Finder

For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T08:43:15" when pageSubmitted="/snapcCustomer.xhtml" from requestTime="2009-05-26T08:47:23" when pageSubmitted="/snapcPremium.xhtml" 08:47:23 - 08:43:15 = 4:12 (4 minutes and 12 seconds) This the value I want to compute. How can I achieve this?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

convert dur2sec works well for this one:

<search_terms> | convert dur2sec(requestTime) as reqTimeConverted | convert dur2sec(responseTime) as respTimeConverted | eval duration=respTimeConverted-reqTimeConverted

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

convert dur2sec works well for this one:

<search_terms> | convert dur2sec(requestTime) as reqTimeConverted | convert dur2sec(responseTime) as respTimeConverted | eval duration=respTimeConverted-reqTimeConverted

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!