Splunk Search

Trying to get difference between _time and _indextime in secs format

vinay4444
Explorer

Tried using below search, but can't get result. I get null values in diff:

XXX| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")  |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S")  | eval diff= tostring(indextime - capturetime) | table indextime capturetime diff

Am I missing something?

0 Karma
1 Solution

jplumsdaine22
Influencer

Just do the diff calculation on the actual epoch value, before your strftime evals.

XXX| eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") |  | table indextime capturetime diff

View solution in original post

jplumsdaine22
Influencer

Just do the diff calculation on the actual epoch value, before your strftime evals.

XXX| eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") |  | table indextime capturetime diff

vinay4444
Explorer

i tried that but it does not give the difference in min or secs
e.g
capturetime indextime diff
2015-12-04 07:33:44 2015-12-04 07:33:50 6

0 Karma

jplumsdaine22
Influencer

The diff field is in seconds.
The _indextime and _time fields are in unix epoch time format, the number of seconds since January 1970. When you subtract one from the other the result is a value expressed in seconds

0 Karma

vinay4444
Explorer

Ok got it thanks!

0 Karma

jplumsdaine22
Influencer

No problem mate. If that's working for you do you mind accepting the answer?

Cheers

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...