eval duration/latency

Mohsin123 · ‎07-23-2018

My timestamp-in and timestamp-out fields are in this format 2018-07-23T15:53:11.588Z
how do i calculate duration ?
i am calculating latency in time i.e response code .

i tried |eval tin=substr(tostring(timestamp-in),12,23) and also strptime

Anyone can help ?

somesoni2 · ‎07-23-2018

Try like this

your current search | eval latency=strptime('timestamp-out',"%Y-%m-%dT%H:%M:%S.%3N%Z")-strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%3N%Z")

eval duration/latency

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation

eval duration/latency

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance