Splunk Search

Time coversion not working

nwoolley
Engager

index=asg Process_name=WLR_22-15_Rating earliest =-5m | convert timeformat="%d-%M-%Y-%H:%M:%S" mktime(start_dtm) mktime(end_dtm) | eval duration=end_time-start_time | table duration

Data
15-OCT-2019-11:25:02,Process_name=WLR_22-15_Rating,start_dtm=14-OCT-2019-22:15:40,end_dtm=15-OCT-2019-00:47:36,errors=10503,work_done=651649

Not sure why the above is failing any help would be grateful thanks

Tags (1)
0 Karma

nwoolley
Engager

Perfect answer very quick thank you

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nwoolley

Can you please try this?

index=asg Process_name=WLR_22-15_Rating earliest =-5m 
| eval start_time=strptime(start_dtm,"%d-%b-%Y-%H:%M:%S"), end_time=strptime(end_dtm,"%d-%b-%Y-%H:%M:%S") 
| eval duration=end_time-start_time 
| table duration

Example:

| makeresults 
| eval _raw="15-OCT-2019-11:25:02,Process_name=WLR_22-15_Rating,start_dtm=14-OCT-2019-22:15:40,end_dtm=15-OCT-2019-00:47:36,errors=10503,work_done=651649" 
| extract 
| eval start_time=strptime(start_dtm,"%d-%b-%Y-%H:%M:%S"), end_time=strptime(end_dtm,"%d-%b-%Y-%H:%M:%S") | eval duration=end_time-start_time | table duration
0 Karma

nwoolley
Engager

Perfect answer very quick thank you

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great @nwoolley

Please upvote and accept this answer to close this question.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...