Here is my current code:
index="sandbox" sourcetype="AS-CDR" | where Called_Number="2155551060" OR
Calling_Number="2155551060" OR
Called_Number="12155551060" OR
Calling_Number="12155551060" OR
Called_Number="+12155551060" OR
Calling_Number="+12155551060" |eval timeToAnswer=(strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q"))
When I attempt to perform that operation, it doesn't give me any value for timeToAnswer, even though the operator is supposed to create a new column that can be used. I know it works because I can take an average using avg(timeToAnswer) and get a result. But if I try to append
|fields Start_Time Answer_Time timeToAnswer
It doesn't show. Can anyone explain how to fix this? The timestamps are in the following format:
20110119212921.053
If you select the timeToAnswer field from the field picker, does it show its top 10 values?
"fields" is not used to display a field under the raw text of the events. You can use the field picker on the left to "always show" the field timeToAnswer or the
... | table Start_Time Answer_Time timeToAnswer
command to display tabular results. Let us know if it worked!
If you select the timeToAnswer field from the field picker, does it show its top 10 values?
"fields" is not used to display a field under the raw text of the events. You can use the field picker on the left to "always show" the field timeToAnswer or the
... | table Start_Time Answer_Time timeToAnswer
command to display tabular results. Let us know if it worked!
We are all very lucky that Splunk's manual is really well done 😄
Thanks! Reading through the manual is a pretty good exercise, I should try it more often 😉