×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jr_arzuaga
Explorer
Member since: ‎11-28-2012
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎11-28-2012
Activity Feed
View All

Re: Eval On Field With Multiple Values

by in Splunk Search
‎11-30-2012 07:33 AM
‎11-30-2012 07:33 AM
UPDATE: This doesn't work either source="/Users/user/unit_pretest_.json" | lookup UserSessionsLookup user_id as userId | rename username as "User Name" | stats sum(strptime(end_date,"%Y-%m-%d %H:%M:%S")-strptime(start_date,"%Y-%m-%d %H:%M:%S")) as TimeDiff by "User Name" | table "User Name", TimeDiff ... View more

Re: Eval On Field With Multiple Values

by in Splunk Search
‎11-30-2012 07:26 AM
‎11-30-2012 07:26 AM
UPDATE: This is the new search I'm trying: source="/Users/user/unit_pretest_.json" lookup UserSessionsLookup user_id as userId | rename username as "User Name" | eval itime=strptime(start_date,"%Y-%m-%d %H:%M:%S") | eval ptime=strptime(end_date,"%Y-%m-%d %H:%M:%S") | eval TimeDiff=ptime-itime | stats sum(TimeDiff) as Diff by "User Name" | table "User Name", start_date, end_date, Diff I get the same thing, data for users with only one row of sessions data (e.g. User1 and User4 above) ... View more

Re: Eval On Field With Multiple Values

by in Splunk Search
‎11-30-2012 06:41 AM
‎11-30-2012 06:41 AM
Not working. It won't allow me to do eval(ptime-itime). It seems like what I need to do is compute the difference and then group by the "User Name" but the syntax above doesn't work. Any thoughts? ... View more

Eval On Field With Multiple Values

by in Splunk Search
‎11-29-2012 06:20 PM
2 Karma
‎11-29-2012 06:20 PM
2 Karma
I'm trying to get the time difference of two dates on a table but when my user has multiple values for the end_date and start_dates my time_diff is not calculated. See below: User end_date start_date time_diff User1 2011-11-04T13:17Z 2011-11-04 09:18:20 14320 User2 2011-11-04T21:08Z 2011-11-04 14:08:28 2011-11-04T15:16Z 2011-11-04 16:38:16 User3 2011-11-04T15:15Z 2011-11-04 10:18:12 2011-11-04T21:25Z 2011-11-04 14:26:40 2011-11-04T13:35Z 2011-11-04 09:36:45 User4 2011-11-04T20:01Z 2011-11-04 16:03:02 13889 Search: source="/Users/user/unit_pretest_.json" | lookup UserSessionsLookup user_id as userId | rename username as "User Name" | eval itime=strptime(start_date,"%Y-%m-%d %H:%M:%S") | eval ptime=strptime(end_date,"%Y-%m-%d %H:%M:%S") | eval TimeDiff=ptime-itime | table "User Name", start_date, end_date, TimeDiff Anyone knows what's wrong here? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All