Splunk Search

How to subtract times for different events

xvxt006
Contributor

Hi,

i have multiple events for each order and i want to subtract start and end events for each order. So i have created a filed called "action" and which gives whether it is a start or end event. So the value for "action" field would be start or end. i have converted time to numeral number but i am not sure how to get times for start and end and then subtract for each order to calculate the latency. i have used the query below. but not sure how to move forward. Any suggestions please.

| convert mktime(_time) as T1 | eval Type=if(action=start,"start","end") | stats values(T1) as Time by Type, Order | eval Latency = ("Time: start" - "Time: end") |

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this (assuming the value of the field Type is either 'start' or 'end')

your base search | chart first(_time) over action by OMSOrder | eval latency=end-start

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this (assuming the value of the field Type is either 'start' or 'end')

your base search | chart first(_time) over action by OMSOrder | eval latency=end-start

xvxt006
Contributor

i got it. i have used | convert dur2sec(Latency)

somesoni2
SplunkTrust
SplunkTrust

The latency calculated here will be seconds already (as end and start are epoch time). You want to format the latency value to any specify format? If you want to format it as duration, your can use this in the search.

after chart command | eval latency=tostring(end-start,"duration")

0 Karma

xvxt006
Contributor

One question is, i get the latency and when i use strftime i am getting the actual time but not the duration in secs or millli seconds. is there any function for that

0 Karma

xvxt006
Contributor

Awesome..Simple is better

0 Karma

strive
Influencer

Since start occurs first and end in the last, can you try this simple approach...
Your search... | stats max(_time) as End, min(_time) as Start by OMSOrder | eval Latency = End - Start

strive
Influencer

_time is already in epoch format right? why do you need to convert?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...