Splunk Search

calculate duration on a custom time stamp

twilishyflutter
New Member

my time stamps are in %H:%M format. one of which is a custom time stamp from my json file.
is there a way i can calculate the duration with this timestamp

Tags (1)
0 Karma

cmerriman
Super Champion

try something like:

| eval newTime=strptime(timeStr, "%H:%M")

to convert the timestamps and then you should be able to use that in an eval to substract timestamps.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...