Splunk Search

not getting the time difference

pench2k19
Explorer

Hi splunkers,

i m trying to calculate the time differece in minutes between the two fields sla_time and FILE_ARRIVALTIME . It seems the correct query for me , but not getting the time difference value from the following query. Any of you can help?

query:
| inputlookup SLA.csv |table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD|eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d"))|eval sla_time=replace (sla_time,","," ") |table SOR_NAME sla_time |join type=outer SOR_NAME [search index=xxx|rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)"|rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") |fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] |eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M")| eval time_diff = tostring((FILE_ARRIVALTIME_epoch-sla_time_epoch), "duration") |table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME time_diff

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@pench2k19

Can you please confirm below search will have data in all fields ( SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch) ??

| inputlookup SLA.csv 
| table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD 
| eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d")) 
| eval sla_time=replace (sla_time,","," ") 
| table SOR_NAME sla_time 
| join type=outer SOR_NAME 
    [ search index=xxx 
    | rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)" 
    | rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" 
    | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") 
    | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) 
    | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") 
    | fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] 
| eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M") 
| table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch 

Thanks

0 Karma

pench2k19
Explorer

yes it does have all the fields....

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please share sample results ( first 5 rec) ?

0 Karma

pench2k19
Explorer

@vnravikumar

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...