Issue with doing math on event times?

[msarro]

Here is my current code:

index="sandbox" sourcetype="AS-CDR" | where Called_Number="2155551060" OR
       Calling_Number="2155551060" OR
       Called_Number="12155551060" OR
       Calling_Number="12155551060" OR
       Called_Number="+12155551060" OR
       Calling_Number="+12155551060" |eval timeToAnswer=(strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q"))

When I attempt to perform that operation, it doesn't give me any value for timeToAnswer, even though the operator is supposed to create a new column that can be used. I know it works because I can take an average using avg(timeToAnswer) and get a result. But if I try to append

|fields Start_Time Answer_Time timeToAnswer

It doesn't show. Can anyone explain how to fix this? The timestamps are in the following format:

20110119212921.053

[Paolo_Prigione · Accepted solution]

If you select the timeToAnswer field from the field picker, does it show its top 10 values?

"fields" is not used to display a field under the raw text of the events. You can use the field picker on the left to "always show" the field timeToAnswer or the

... | table Start_Time Answer_Time timeToAnswer

command to display tabular results. Let us know if it worked!

[Paolo_Prigione]

We are all very lucky that Splunk's manual is really well done 😄

[msarro]

Thanks! Reading through the manual is a pretty good exercise, I should try it more often 😉