Splunk Search

Subtract different time format

criedman
Explorer

Hello,

i have only two values logout_time and online_time and i would like to get the login_time.
How could i subtract the online_time from the logout_time ?

search:
index="index_5" sourcetype="system:logins"
| table logout_time,online_time,login_time

alt text

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

try this search anywhere:

| makeresults count=1
| eval online_time = "01:16,04:17,18:02,00:43,12:12,110:00"
| makemv delim="," online_time
| mvexpand online_time
| eval logout_time = _time - random()%500
| eval logout_time_human = strftime(logout_time, "%c")
| rename COMMENT as "the above generates data below is a step by step solution, some steps can be combined"
| rex field=online_time "(?<hours>\d+)\:(?<minutes>\d+)"
| eval hours_in_sec = hours * 3600
| eval minutes_in_sec = minutes * 60
| eval online_time_in_sec = hours_in_sec + minutes_in_sec
| eval logon_epoch_time = logout_time - online_time_in_sec
| eval logon_human_time = strftime(logon_epoch_time, "%c")
| table logout_time_human logout_time logon_human_time logon_epoch_time online_time online_time_in_sec hours minutes

note, there are other ways to accomplish, the above is a step by step. you can build the query line by line and see how it works

hope it helps

View solution in original post

0 Karma

criedman
Explorer

Great Thank You !

0 Karma

adonio
Ultra Champion

try this search anywhere:

| makeresults count=1
| eval online_time = "01:16,04:17,18:02,00:43,12:12,110:00"
| makemv delim="," online_time
| mvexpand online_time
| eval logout_time = _time - random()%500
| eval logout_time_human = strftime(logout_time, "%c")
| rename COMMENT as "the above generates data below is a step by step solution, some steps can be combined"
| rex field=online_time "(?<hours>\d+)\:(?<minutes>\d+)"
| eval hours_in_sec = hours * 3600
| eval minutes_in_sec = minutes * 60
| eval online_time_in_sec = hours_in_sec + minutes_in_sec
| eval logon_epoch_time = logout_time - online_time_in_sec
| eval logon_human_time = strftime(logon_epoch_time, "%c")
| table logout_time_human logout_time logon_human_time logon_epoch_time online_time online_time_in_sec hours minutes

note, there are other ways to accomplish, the above is a step by step. you can build the query line by line and see how it works

hope it helps

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...