Splunk Search

Get the Time difference from the logs to display in "%d/%m/%Y %H:%M:%S" format

harshal_chakran
Builder

Hi All,
I have a csv file, as following:

`

FINISH_DATE START_DATE
30/09/09 19:51:16 30/09/09 19:49:03

01/10/09 16:58:44 01/10/09 16:55:48

02/10/09 16:54:08 02/10/09 16:53:17

`

I want to find the difference between the two timestamps, and display it in third column in "%d/%m/%Y %H:%M:%S" format.
for e.g. the difference for the first row should be like 30/09/09 00:2:13
I have tried the following query, but it didnt helped.

convert timeformat="%d/%m/%y %H:%M:%S" mktime(START_DATE) as  mktime(FINISH_DATE) as finish_date_epoch | eval diff_date_epoch=start_date_epoch -finish_date_epoch|eval DIFF_DATE=strftime(diff_date_epoch,"%H:%M:%S")

What I am doing wrong?
Please Help...!!!

0 Karma

lguinn2
Legend

Try this:

convert timeformat="%d/%m/%y %H:%M:%S" mktime(START_DATE) as start_date_epoch  
mktime(FINISH_DATE) as finish_date_epoch 
| eval DIFF_DATE=tostring(start_date_epoch -finish_date_epoch,"duration")

Also note that the duration will not contain a month/day/year, because that doesn't make any sense for a difference. The difference is not a date.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Is this actually missing ? You should have start_date_epoch where I've put MISSING:

convert timeformat="%d/%m/%y %H:%M:%S" mktime(START_DATE) as  **MISSING**
mktime(FINISH_DATE) as finish_date_epoch 
| eval diff_date_epoch=start_date_epoch -finish_date_epoch
| eval DIFF_DATE=strftime(diff_date_epoch,"%H:%M:%S")

I'm assuming thats just a typo in your post...

Maybe you can break apart your search and see which part fails, e.g.

convert timeformat="%d/%m/%y %H:%M:%S" mktime(START_DATE) as  start_date_epoch
mktime(FINISH_DATE) as finish_date_epoch 
| table start_date_epoch, finish_date,epoch

Then progressively add the evals. Then you might have a better idea of where its breaking...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...