Splunk Search

calculate difference between 2 dates and times with strftime

Sfry1981
Communicator

I have the below search:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

the evals for start and stop are working fine but the eval for difftime is not working. As I'm using strftime how can i calculate the duration between the 2 dates and times?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using strptime first. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

jpolvino
Builder

You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

This will give you diffTime in seconds, which you can do with what you want.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using strptime first. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...