Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ykoolhout
ykoolhout
Explorer
Member since:
12-11-2018
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 12-11-2018 |
Activity Feed
- Karma Re: How can I subtract two timestamp fields in a transaction to get duration? for whrg. 06-05-2020 12:50 AM
- Karma Re: How can I subtract two timestamp fields in a transaction to get duration? for whrg. 06-05-2020 12:50 AM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-12-2018 12:44 AM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 12:15 PM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 11:19 AM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 05:06 AM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 04:53 AM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 04:51 AM
- Posted Re: How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 04:30 AM
- Posted How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 01:19 AM
- Tagged How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 01:19 AM
- Tagged How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 01:19 AM
- Tagged How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 01:19 AM
- Tagged How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 01:19 AM
- Tagged How can I subtract two timestamp fields in a transaction to get duration? on Getting Data In. 12-11-2018 01:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
12-12-2018
12:44 AM
Guess it's so simple you look over it. But the single quotes work aswell! Thanks.
... View more
12-11-2018
12:15 PM
Fixed it, turns out indeed the dot between "engine.currentTimestamp" was causing the problem.
a simple "rename *** AS ****" fixed the problem. Thanks for the input whrg!
... View more
12-11-2018
11:19 AM
You were right, the dot caused an issue. I believe there is something I'm missing though. I was expecting the firstValue1 and secondValue1 to set the value of the timestamp, not the name of the field. Heres a sample output below:
Perhaps something with mvlist or mvindex?
... View more
12-11-2018
05:06 AM
This is what it returns as one event with the transaction command:
{
"engine": {
"currentTimestamp": "2018-12-11T13:54:16.869+01:00",
"localization": "Central European Time",
"processId": "10790@DESKTOP-68CLR",
"applicationName": "cr_quotes",
"messageId": "de1d3e0-fd4311e8-811c-005056a4ee"
},
"tracepoint": "Entry"
}
{
"engine": {
"currentTimestamp": "2018-12-11T13:54:16.967+01:00",
"localization": "Central European Time",
"processId": "10790@DESKTOP-68CLR",
"applicationName": "cr_quotes",
"messageId": "de46d3e0-fd43-11e8-8f1c-0050563ee"
},
"tracepoint": "Exit"
}
Hope this answers the question!
... View more
12-11-2018
04:53 AM
Not too sure how to check this
... View more
12-11-2018
04:51 AM
This seems to have fixed the time layout, as this command works. Something else seems to be going on though.
... View more
12-11-2018
04:30 AM
Hi whrg,
A single value would be as follows:
"currentTimestamp": "2018-12-11T13:24:16.869+01:00"
Though in a transaction it would have multiple timestamps.
... View more
12-11-2018
01:19 AM
Helllo, I've been trying to subtract two timestamp fields from each other within a transaction. A timestamp as such:
2018-12-11T09:54:16.869+01:00
2018-12-11T09:54:16.874+01:00
The current search I'm using is as follows:
index=testindex sourcetype="_json"
| transaction engine.correlationId startswith="tracepoint=Entry" endswith="tracepoint=Exit" mvlist=engine.currentTimestamp
| eval firstValue1=mvindex(engine.currentTimestamp,0)
| eval secondValue1=mvindex(engine.currentTimestamp,1)
| eval end_time_epoch = strptime(firstValue1, "%Y-%m-%dT%H:%M:%S.%f")
| eval begin_time_epoch = strptime(secondValue1, "%Y-%m-%dT%H:%M:%S.%f")
| eval duration = end_time_epoch - begin_time_epoch
| table engine.currentTimestamp firstValue1 secondValue1 duration
I was expecting to get "duration" as the two timestamps subtracted from the from each other, which would give the difference in milliseconds. For some reason, only engine.currentTimestamp is returning the multiple timestamp-values of the transaction and the other fields are returning empty in the table.
Perhaps it is the mvlist, which isn't working, but it could also be the calculation since it is trying to subtract within a transaction that has 2 or 3 timestamps from 2 or 3 events.
Any ideas?
Thanks in advance!
... View more
