Splunk Search
Highlighted

## time difference between two rows same field

Path Finder

How to calculate difference between both the times ? One with alertstatus=Problem and other with alertstatus=OK

Tags (2)
1 Solution
Highlighted

## Re: time difference between two rows same field

Contributor

Hi,
You can use appendcols.... something like (assuming and alert name of "aname"):
`|inputlookup yourlookupfile|search alertname=aname alertdate="*Sep 25*" AND alertstatus="Problem"|eval stime=strptime(alertdate, "%a %b %d %H:%M:%S %Y")|appendcols [|inputlookup yourlookupfile|search alertname=aname alertdate="*Sep 25*" AND alertstatus="OK"|eval etime=strptime(alertdate, "%a %b %d %H:%M:%S %Y")]|eval problemDuration_Min=((etime-stime)/60)|fields alertdate,alertname,host,hostname,problemDuration_Min`

Check out available time functions and Date/Time format options

Highlighted

## Re: time difference between two rows same field

Esteemed Legend

Like this:

``````| inputlookup zbxAlertReport
| eval atertEpoch = strftime(alertdate, "%a %b %D %H:%M:%S %Y"
| streamstats current=f last(alertEpoch) AS nextTime
| eval  timeDelta = nextTime - alertEpoch
``````
Highlighted

## Re: time difference between two rows same field

Path Finder

Thank you so much Yasaswy it worked. Thanks a lot.

Thanks Woodcock, but somehow it didnt work for me.

Highlighted

## Re: time difference between two rows same field

Esteemed Legend

I forgot that `inputlookup` does not create `_time` so I went back and updated my answer so that it should work.

Highlighted

## Re: time difference between two rows same field

Esteemed Legend

You should try all the answers and whichever one works best, click "Accept" to close out the question.

Highlighted

## Re: time difference between two rows same field

SplunkTrust

Try something like this

``````| inputlookup zbxAlertReport | search alertname="Jboss server.log size exceeded 5GB on dc10schdjob01.syd.sf.priv" alertdate="*Sep 25* | convert mktime(alertdate)  timeformat="%a %b %D %H:%M:%S %Y" | diff attribute=alertdate
``````