not getting the time difference

[pench2k19]

Hi splunkers,

i m trying to calculate the time differece in minutes between the two fields sla_time and FILE_ARRIVALTIME . It seems the correct query for me , but not getting the time difference value from the following query. Any of you can help?

query:
| inputlookup SLA.csv |table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD|eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d"))|eval sla_time=replace (sla_time,","," ") |table SOR_NAME sla_time |join type=outer SOR_NAME [search index=xxx|rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)"|rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") |fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] |eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M")| eval time_diff = tostring((FILE_ARRIVALTIME_epoch-sla_time_epoch), "duration") |table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME time_diff

[kamlesh_vaghela]

@pench2k19

Can you please confirm below search will have data in all fields ( SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch) ??

| inputlookup SLA.csv 
| table SOR_NAME SOR_TDQ_FAIL_SLA_THRESHOLD 
| eval sla_time =replace (SOR_TDQ_FAIL_SLA_THRESHOLD,"^\w++\d" ,strftime(now(), "%Y-%m-%d")) 
| eval sla_time=replace (sla_time,","," ") 
| table SOR_NAME sla_time 
| join type=outer SOR_NAME 
    [ search index=xxx 
    | rex "info\s:\s+{4}\sSTARTED\s+{4}\sJob run_ingest_(?\w+)(?\d+-\d+-\d+-\d+-\d+-\d+)" 
    | rex field=Datafeed_name "^(?\w{2,5})_(?\w+)$" 
    | eval FILE_ARRIVALTIME = strftime(strptime(start_time,"%Y-%m-%d-%H-%M-%S") ,"%Y-%m-%d %H:%M:%S") 
    | eval FILE_ARRIVALTIME = substr(FILE_ARRIVALTIME, 1, len(FILE_ARRIVALTIME)-3) 
    | eval FILE_ARRIVALTIME_epoch=strptime(FILE_ARRIVALTIME,"%Y-%m-%d %H:%M") 
    | fields SOR_NAME FEED_NAME FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch] 
| eval sla_time_epoch = strptime(sla_time,"%Y-%m-%d %H:%M") 
| table SOR_NAME FEED_NAME sla_time FILE_ARRIVALTIME FILE_ARRIVALTIME_epoch sla_time_epoch 

Thanks

[pench2k19]

yes it does have all the fields....

[kamlesh_vaghela]

Can you please share sample results ( first 5 rec) ?

[pench2k19]

@vnravikumar