Trying to create and populate a ProcessingTime field from 2 time fileds

[kesrich]

I have a log that that has multiple utc times listed. The logs are ingested into Splunk and I have created a field extraction to show those times in my Splunk table query. Now I am trying to populate the ProcessingTime with the difference between two of the fields. I'm missing something. Can't get the ProcessingTime to populate. Any help would be great.

Query:
host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=file_modified-file_created
| table ProcessingTime, file_modified, file_created, corp_copy_dt

Sample Result:

ProcessingTime file_modified file_created corp_copy_dt  

+2021-04-19T18:15:19:564+00:00-UTC

+2021-04-19T18:15:19:299+00:00-UTC

+2021-04-19T15:15:19:000+00:00-UTC

+2021-04-19T18:15:18:955+00:00-UTC

+2021-04-19T18:15:18:689+00:00-UTC

+2021-04-19T15:15:19:000+00:00-UTC

+2021-04-19T18:15:20:470+00:00-UTC

+2021-04-19T18:15:19:924+00:00-UTC

+2021-04-19T15:15:20:000+00:00-UTC

+2021-04-19T18:15:21:205+00:00-UTC

+2021-04-19T18:15:20:861+00:00-UTC

+2021-04-19T15:15:21:000+00:00-UTC

[kesrich]

@manjunathmeti 
This looks like a great start, but can we remove the "round" option? And is there a way to format the display of the ProcessingTime? I need the milliseconds of this. Thanks for the quick reply!!

[manjunathmeti]

Yes, you can, using tostring function.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=tostring(strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"), "duration")
| table ProcessingTime, file_modified, file_created, corp_copy_dt

If this reply helps you, a like would be appreciated. 

[manjunathmeti · Accepted solution]

hi @kesrich,
You need to convert date time to epoch time and then calculate the difference. Below query gives ProcessingTime in hours.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=round((strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"))/3600, 2)
| table ProcessingTime, file_modified, file_created, corp_copy_dt

If this reply helps you, a like would be appreciated.