Splunk Search

splunk timestamp calculation query


Hi guys,


I am looking for a splunk query for following table 


Job1   2021-05-01 22:19:23
  2021-05-01 22:19:22
  2021-05-01 19:54:38
  2021-05-01 19:52:37



Expected output:



JobNameJob timeTimecalculationTotaltime
Job1 2021-05-01 22:19:231( sec) from first two entries time difference=1+121=122 seconds
  2021-05-01 22:19:22  
  2021-05-01 19:54:38 2 minutes:1 second from entries 3 and 4 = 121 seconds 
  2021-05-01 19:52:37  



0 Karma


Splunk works from events - what do your events look like? Are all the 4 timestamps in the same event? are the JobNames unique? Does the JobName appear in all events with the timestamps? Are there only ever 4 timestamps per JobName? Can there by fewer or more timestamps per JobName?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!