Splunk Search

Unable to calculate a difference after using mvindex with _time field

tewarbit
New Member

I am using a transaction to combine events and I want to calculate the difference in time between the two events. I am getting a "Typechecking failed. '-' only takes numbers" error when trying to do subtraction on the _time field. Is there a way to do this?
Here is my search:

"Starting task" OR "Terminating task"
| eval myTime = _time 
| transaction pid 
| eval duration = mvindex(myTime, 1)-mvindex(myTime, 0), startTime = strftime(mvindex(myTime, 0), "%m/%d/%Y %H:%M:%S"), endTime = strftime(mvindex(myTime, 1), "%m/%d/%Y %H:%M:%S") 
| table pid startTime endTime duration

***Edit*
Responding to grittonc's question:
Yes - I am certain myTime is multi-valued. I can properly see the startTime and endTime values populating correctly in my table. Also - here is a snippet of the combined event:
alt text

0 Karma
1 Solution

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

View solution in original post

0 Karma

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

0 Karma

tewarbit
New Member

Both ways worked perfectly. Thanks!

0 Karma

grittonc
Contributor

Are you sure that you are ending up with a multi-value field called myTime? Can you post sample data, anonymized if necessary?

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...