- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm able to create the following calculated field in the Search app.
.... | eval KCQueueDuration = (strptime(KCQStartDate." ".KCQStartTime, "%Y-%m-%d %H:%M:%S")) - (strptime(KCQEndDate." ".KCQEndTime, "%Y-%m-%d %H:%M:%S"))
However, I'm not able to get it to work when I create this field using the Splunk Web App (Settings->Fields->Calculated Fields) or editing the props.conf file. The field doesn't show up in the list of interesting fields, when I just search for all events for the source type. If I use this process to create a calculated field that just contains 1 of the strptime functions, it appears in the list of interesting fields.
Below is an example of the event data.
KCUID=905252z911311o,KCQStartDate=2016-01-06,KCQStartTime=15:19:46,KCQEndDate=2016-01-06,KCQEndTime=15:19:48
I couldn't find anything indicating that this expression is invalid in props.conf. Is this a known limitation of calculated fields in props.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![sundareshr sundareshr](https://community.splunk.com/legacyfs/online/avatars/344285.jpg)
I just tried this and it worked for me
EVAL-KCQueueDuration = (strptime(KCQStartDate." ".KCQStartTime, "%Y-%m-%d %H:%M:%S") - strptime(KCQEndDate." ".KCQEndTime, "%Y-%m-%d %H:%M:%S"))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![sundareshr sundareshr](https://community.splunk.com/legacyfs/online/avatars/344285.jpg)
I just tried this and it worked for me
EVAL-KCQueueDuration = (strptime(KCQStartDate." ".KCQStartTime, "%Y-%m-%d %H:%M:%S") - strptime(KCQEndDate." ".KCQEndTime, "%Y-%m-%d %H:%M:%S"))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried your expression, and it also worked for me. It was one of the expression permutations I didn't think of trying.
Thanks for your help resolving this issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![lguinn2 lguinn2](https://community.splunk.com/legacyfs/online/avatars/109473.jpg)
Perhaps it is a permissions problem? In which app did you create the calculated field and what are its permissions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![aljohnson_splun aljohnson_splun](https://community.splunk.com/legacyfs/online/avatars/238482.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
Most likely its an ordering-of-the-knowledge-objects issue. Are any of the fields in your calculated field coming from an alias or lookup?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The fields in the calculated field expression are not alias or lookup fields. If I create a calculated field that just contains: strptime(KCQStartDate." ".KCQStartTime, "%Y-%m-%d %H:%M:%S"), it works. Likewise, it works if I create a calculated field with just strptime(KCQEndDate." ".KCQEndTime, "%Y-%m-%d %H:%M:%S"), it works.
The calculated field doesn't work when I tried to combine the 2 expressions to calculate a duration value.
![](/skins/images/53C7C94B4DD15F7CACC6D77B9B4D55BF/responsive_peak/images/icon_anonymous_message.png)