Splunk Search

Trying to create and populate a ProcessingTime field from 2 time fileds

kesrich
Explorer

I have a log that that has multiple utc times listed. The logs are ingested into Splunk and I have created a field extraction to show those times in my Splunk table query. Now I am trying to populate the ProcessingTime with the difference between two of the fields. I'm missing something. Can't get the ProcessingTime to populate. Any help would be great.

Query:
host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=file_modified-file_created
| table ProcessingTime, file_modified, file_created, corp_copy_dt

Sample Result:

ProcessingTime file_modified file_created corp_copy_dt  

 +2021-04-19T18:15:19:564+00:00-UTC+2021-04-19T18:15:19:299+00:00-UTC+2021-04-19T15:15:19:000+00:00-UTC  +2021-04-19T18:15:18:955+00:00-UTC+2021-04-19T18:15:18:689+00:00-UTC+2021-04-19T15:15:19:000+00:00-UTC  +2021-04-19T18:15:20:470+00:00-UTC+2021-04-19T18:15:19:924+00:00-UTC+2021-04-19T15:15:20:000+00:00-UTC  +2021-04-19T18:15:21:205+00:00-UTC+2021-04-19T18:15:20:861+00:00-UTC+2021-04-19T15:15:21:000+00:00-UTC      
Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @kesrich,
You need to convert date time to epoch time and then calculate the difference. Below query gives ProcessingTime in hours.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=round((strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"))/3600, 2)
| table ProcessingTime, file_modified, file_created, corp_copy_dt

 

If this reply helps you, a like would be appreciated.

View solution in original post

kesrich
Explorer

@manjunathmeti 
This looks like a great start, but can we remove the "round" option? And is there a way to format the display of the ProcessingTime? I need the milliseconds of this. Thanks for the quick reply!!

0 Karma

manjunathmeti
Champion

Yes, you can, using tostring function.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=tostring(strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"), "duration")
| table ProcessingTime, file_modified, file_created, corp_copy_dt

 

If this reply helps you, a like would be appreciated. 

manjunathmeti
Champion

hi @kesrich,
You need to convert date time to epoch time and then calculate the difference. Below query gives ProcessingTime in hours.

host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log"
| eval ProcessingTime=round((strptime(file_modified, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z")-strptime(file_created, "+%Y-%m-%dT%H:%M:%S:%3N%:z-%Z"))/3600, 2)
| table ProcessingTime, file_modified, file_created, corp_copy_dt

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...