Splunk Search

splunk timestamp calculation query

Csingh
Engager

Hi guys,

 

I am looking for a splunk query for following table 

 

JobNameJobtime
  
  
Job1   2021-05-01 22:19:23
  2021-05-01 22:19:22
  2021-05-01 19:54:38
  2021-05-01 19:52:37
  
  
  

 

 

Expected output:

 

 

JobNameJob timeTimecalculationTotaltime
Job1 2021-05-01 22:19:231( sec) from first two entries time difference=1+121=122 seconds
  2021-05-01 22:19:22  
  2021-05-01 19:54:38 2 minutes:1 second from entries 3 and 4 = 121 seconds 
  2021-05-01 19:52:37  

 

 

0 Karma

ITWhisperer
Legend

Splunk works from events - what do your events look like? Are all the 4 timestamps in the same event? are the JobNames unique? Does the JobName appear in all events with the timestamps? Are there only ever 4 timestamps per JobName? Can there by fewer or more timestamps per JobName?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!