duration calculator with current time

[jerinvarghese]

Need help in find a query to get the duration of the alert w.r.t the current time.

Current code am using:

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" AND ("*WANR*" OR "*LAN*") 
| search * 
| rex field=eventuei "uei.opennms.org/nodes/node(?<bgpPeerState>.+)"
 | stats max(_time) as Time_IST latest(bgpPeerState) as Status by nodelabel
 | where Status="Down"

 | lookup ONMS_nodes.csv nodelabel OUTPUT nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| lookup GRDB_site_list.csv "Site Code" as sitecode OUTPUT Region, Country,"Precious Metal" as Metal, "Site Classification" as Class
| eval Region=mvindex(Region,0) 
| eval Country=mvindex(Country,0) 
| eval Metal=mvindex(Metal,0)
| eval sitecode=if(isnull(sitecode),"Unknown", sitecode) 
| eval Country=if(isnull(Country),"Unknown", Country) 
| eval Metal=if(isnull(Metal),"Unknown", Metal) 
| eval Class=if(isnull(Class),"Unknown", Class) 
| eval Region=if(isnull(Region),"Unknown", Region)
| search Country="*"

| rename nodelabel as "Hostname" ,   Class as Classification, sitecode as "Site Code"

| fieldformat Time_IST=strftime(Time_IST+10.5*3600,"%Y-%m-%d %l:%M:%S %p")
 | sort- Time_IST
 | table Hostname Status Classification "Site Code" Time_IST

Table of output below:

    Hostname    Status  Classification  Site Code   Time_IST
1   GBABO-1 Down    Silver  ABO 2020-05-05  1:33:37 PM
2   GBABO-2 Down    Silver  ABO 2020-05-05  1:33:15 PM

I am looking for a query to get the duration of the event.

Table am expecting.

Hostname    Status  Classification  Site Code   Time_IST    Duration

My splunk timing is in CST time zone.

[richgalloway]

Perhaps this will help.

...| sort- Time_IST
| eval Duration = tostring(now() - Time_IST, "duration")
| table Hostname Status Classification "Site Code" Time_IST Duration