Splunk Search

Strftime adds 1 hour after converting

MedralaG
Communicator

I'm working on identifying which hosts are located in which time zone as the client does not have an inventory list and they have devices all around the globe.
I'm calculating the difference between the _time that was extracted from the log and _indextime to establish the difference between them, which will be a good indication of how many time zones the devices is away.
I get values of ranges around 0-15, around 3600 and around 7200, which is expected.
Now when I try to use strftime to express that difference into a readable format it always adds 1 hour to it.

1 Solution

damien_chillet
Builder

Don't use strftime to deal with durations, use the following (where diff is your difference value in seconds):

 | eval diff=tostring(diff, "duration")

View solution in original post

damien_chillet
Builder

Don't use strftime to deal with durations, use the following (where diff is your difference value in seconds):

 | eval diff=tostring(diff, "duration")

pheonix101
New Member

Hi damien_chillet, I managed to get a desired value by following your suggestion, but now I get a result as 09:11:00.000000 instead of 09:11:00

I am trying to calculate difference between 2 time ranges 3/27/2018 14:01 and 3/27/2018 23:12.

am I missing something?

0 Karma

MedralaG
Communicator

whats is your string?

0 Karma

pheonix101
New Member

time ranges 3/27/2018 14:01 and 3/27/2018 23:12

index=myindex| eval submit=strptime(in, "%m/%d/%Y %H:%M") | eval response=strptime(out, "%m/%d/%Y %H:%M") | eval Total=response-submit | eval Ntotal=tostring(Total,"duration")

0 Karma

MedralaG
Communicator

hmm, interesting, without spending too much time looking into why it's giving you .0000 you can just do a round command on the Total eval to get rid of those , so:

| eval Total=round(response-submit,0)

pheonix101
New Member

That did the trick. Thanks again 🙂

0 Karma

pheonix101
New Member

I am still trying to learn more about splunk functionality, any suggestions on learning Splunk commands (video guides/reference materials) would be helpful.

0 Karma

MedralaG
Communicator

Nice one, thank you.

0 Karma

damien_chillet
Builder

You welcome 🙂

0 Karma

pheonix101
New Member

Hi damien_chillet,

i managed to get a desired result by following your suggestion,

I am trying to calculate difference between 2 time ranges 3/27/2018 14:01 and 3/27/2018 23:12, but I get a result as 09:11:00.000000 instead of 09:11:00

query:

index=myindex| eval submit=strptime(in, "%m/%d/%Y %H:%M") | eval response=strptime(out, "%m/%d/%Y %H:%M") | eval Total=response-submit | eval Ntotal=tostring(Total,"duration")

please advise.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...