Splunk Search
Highlighted

eval duration/latency

Path Finder

My timestamp-in and timestamp-out fields are in this format 2018-07-23T15:53:11.588Z
how do i calculate duration ?
i am calculating latency in time i.e response code .

i tried |eval tin=substr(tostring(timestamp-in),12,23) and also strptime

Anyone can help ?

Tags (3)
0 Karma
Highlighted

Re: eval duration/latency

SplunkTrust
SplunkTrust

Try like this

your current search | eval latency=strptime('timestamp-out',"%Y-%m-%dT%H:%M:%S.%3N%Z")-strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%3N%Z")