Splunk Search
Highlighted

Strftime adds 1 hour after converting

Communicator

I'm working on identifying which hosts are located in which time zone as the client does not have an inventory list and they have devices all around the globe.
I'm calculating the difference between the _time that was extracted from the log and _indextime to establish the difference between them, which will be a good indication of how many time zones the devices is away.
I get values of ranges around 0-15, around 3600 and around 7200, which is expected.
Now when I try to use strftime to express that difference into a readable format it always adds 1 hour to it.

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

Don't use strftime to deal with durations, use the following (where diff is your difference value in seconds):

 | eval diff=tostring(diff, "duration")

View solution in original post

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

Communicator

Nice one, thank you.

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

You welcome 🙂

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

New Member

Hi damien_chillet,

i managed to get a desired result by following your suggestion,

I am trying to calculate difference between 2 time ranges 3/27/2018 14:01 and 3/27/2018 23:12, but I get a result as 09:11:00.000000 instead of 09:11:00

query:

index=myindex| eval submit=strptime(in, "%m/%d/%Y %H:%M") | eval response=strptime(out, "%m/%d/%Y %H:%M") | eval Total=response-submit | eval Ntotal=tostring(Total,"duration")

please advise.

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

New Member

Hi damien_chillet, I managed to get a desired value by following your suggestion, but now I get a result as 09:11:00.000000 instead of 09:11:00

I am trying to calculate difference between 2 time ranges 3/27/2018 14:01 and 3/27/2018 23:12.

am I missing something?

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

Communicator

whats is your string?

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

New Member

time ranges 3/27/2018 14:01 and 3/27/2018 23:12

index=myindex| eval submit=strptime(in, "%m/%d/%Y %H:%M") | eval response=strptime(out, "%m/%d/%Y %H:%M") | eval Total=response-submit | eval Ntotal=tostring(Total,"duration")

0 Karma
Highlighted

Re: Strftime adds 1 hour after converting

Communicator

hmm, interesting, without spending too much time looking into why it's giving you .0000 you can just do a round command on the Total eval to get rid of those , so:

| eval Total=round(response-submit,0)

Highlighted

Re: Strftime adds 1 hour after converting

New Member

That did the trick. Thanks again 🙂

0 Karma