how to calculate starttime and Endtime duration

[babukumarreddy]

how to calculate starttime and Endtime duration

|08-feb-2019 01:30:18|08-feb-2019 01:30:28

[chrisyounger]

Try this: |eval d1 = strptime(starttime, "%d-%b-%Y %H:%M:%S") | eval d2 = strptime(endtime, "%d-%b-%Y %H:%M:%S") | eval duration_in_seconds = d1 - d2

Hope this helps

[pkarpushin]

Hi @babukumarreddy ,

If I get correctly whay you mean, you have a set of events and you need to calculate the time delta between the earliest and latest event.
You could use stast command:

<your main search here> | stats first(_time) as End, last(_time) as Start | eval Duration=End-Start | ....

But it would be better if you give more detailed description of your goal.

[babukumarreddy]

Hi Pkarpushin

actually iam new to splunk

in my logs starttime and endtime is there need to calculate duration
starttime endtime
|08-feb-2019 01:30:18|08-feb-2019 01:30:28

fieldnames are starttime and endtime