Splunk Search

Unable to calculate a difference after using mvindex with _time field

tewarbit
New Member

I am using a transaction to combine events and I want to calculate the difference in time between the two events. I am getting a "Typechecking failed. '-' only takes numbers" error when trying to do subtraction on the _time field. Is there a way to do this?
Here is my search:

"Starting task" OR "Terminating task"
| eval myTime = _time 
| transaction pid 
| eval duration = mvindex(myTime, 1)-mvindex(myTime, 0), startTime = strftime(mvindex(myTime, 0), "%m/%d/%Y %H:%M:%S"), endTime = strftime(mvindex(myTime, 1), "%m/%d/%Y %H:%M:%S") 
| table pid startTime endTime duration

***Edit*
Responding to grittonc's question:
Yes - I am certain myTime is multi-valued. I can properly see the startTime and endTime values populating correctly in my table. Also - here is a snippet of the combined event:
alt text

0 Karma
1 Solution

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

View solution in original post

0 Karma

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

0 Karma

tewarbit
New Member

Both ways worked perfectly. Thanks!

0 Karma

grittonc
Contributor

Are you sure that you are ending up with a multi-value field called myTime? Can you post sample data, anonymized if necessary?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...