So I’m pretty new to splunk and I do feel like this should be a lot simpler than I’m making it.
I need two epoch times that are in the same cell to be substracted from each other and I haven’t been able to find anything that can help with it or figure it out myself. I didn't want to use mvexpand because I want the subtraction to be based off of the user
My search result looks like this rn:
Name | Epoch |
UserA | 1625037039 1625037045 |
UserB | 1625050381 1625050423 |
Can you please try this?
YOUR_SEARCH
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))
My Sample Search :
| makeresults | eval _raw="Name Epoch
UserA 1625037039|1625037045
UserB 1625050381|1625050423"
| multikv forceheader=1
| eval Epoch=split(Epoch,"|")
| table Name Epoch
| rename comment as "Upto Now is sample data only"
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hey, thank you for your reply. However I get the following error 😞
-> Error in 'eval' command: Type checking failed. '-' only takes numbers.
Can you please try this?
YOUR_SEARCH
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))
My Sample Search :
| makeresults | eval _raw="Name Epoch
UserA 1625037039|1625037045
UserB 1625050381|1625050423"
| multikv forceheader=1
| eval Epoch=split(Epoch,"|")
| table Name Epoch
| rename comment as "Upto Now is sample data only"
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
worked like a charm, thank you so much! 🙂
| eval epoch=mvindex(epoch,1)-mvindex(epoch,0)