Splunk Search

Difference between two times

mbasharat
Contributor

Hi,

I have two fields in my report. Time_Created and Time_Closed. They are for time an incident ticket was created and then closed.

Their format is:

Time_Created: 12/20/19 11:30
Time_Closed: 1/1/20 16:50

I need to find the difference between both and result in an additional field e.g. Time_to_resolution.

Basically, I need to see how long it took to resolve a ticket from its creation to closure.

Thanks, in advance!!!

Labels (1)
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval Time_Created="12/31/19 11:30",Time_Closed="1/1/20 16:50" 
| eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y %H:%M") -strptime(Time_Created,"%m/%d/%y %H:%M"),0),"duration") 
| eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") |table Time_Created Time_Closed Time_to_resolution

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval Time_Created="12/31/19 11:30",Time_Closed="1/1/20 16:50" 
| eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y %H:%M") -strptime(Time_Created,"%m/%d/%y %H:%M"),0),"duration") 
| eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") |table Time_Created Time_Closed Time_to_resolution
0 Karma

mbasharat
Contributor

Many thanks for promptness. And how about if it is just date only?

Time_Created: 12/20/19
Time_Closed: 1/1/20

To how many days it took.

0 Karma

vnravikumar
Champion

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y") -strptime(Time_Created,"%m/%d/%y"),0),"duration") 
 | eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 day(s)")
0 Karma

mbasharat
Contributor

This is awesome! TY!!! This triggered my curiosity for some additional chart for my use case. How about converting below to month? Either fields with or without time will work because I am using everything you have provided.

Time_Created: 12/20/19 11:30 to MonthCreated=December

Time_Closed: 1/1/20 16:50 to MonthClosed=January

Case statement or whatever is best as you suggest?

0 Karma

vnravikumar
Champion

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval MonthCreated = strftime(strptime(Time_Created,"%m/%d/%y"),"%B"), MonthClosed=strftime(strptime(Time_Closed,"%m/%d/%y"),"%B")
0 Karma

mbasharat
Contributor

Awesome!!! THANK YOU!!!

0 Karma
Get Updates on the Splunk Community!

Testing out the OpenTelemetry Collector With raw Data

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...