Splunk Search

Unable to calculate a difference after using mvindex with _time field

tewarbit
New Member

I am using a transaction to combine events and I want to calculate the difference in time between the two events. I am getting a "Typechecking failed. '-' only takes numbers" error when trying to do subtraction on the _time field. Is there a way to do this?
Here is my search:

"Starting task" OR "Terminating task"
| eval myTime = _time 
| transaction pid 
| eval duration = mvindex(myTime, 1)-mvindex(myTime, 0), startTime = strftime(mvindex(myTime, 0), "%m/%d/%Y %H:%M:%S"), endTime = strftime(mvindex(myTime, 1), "%m/%d/%Y %H:%M:%S") 
| table pid startTime endTime duration

***Edit*
Responding to grittonc's question:
Yes - I am certain myTime is multi-valued. I can properly see the startTime and endTime values populating correctly in my table. Also - here is a snippet of the combined event:
alt text

0 Karma
1 Solution

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

View solution in original post

0 Karma

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

0 Karma

tewarbit
New Member

Both ways worked perfectly. Thanks!

0 Karma

grittonc
Contributor

Are you sure that you are ending up with a multi-value field called myTime? Can you post sample data, anonymized if necessary?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...