Splunk Search

Show the time range of a search in HH:MM in a table

chadman
Path Finder

I would like to show the HH:MM of my search as a field in a table. How can I set that up as a field?

Tags (2)
1 Solution

sundareshr
Legend

Like this

your base search | eval time=strftime(_time, "%H:%M") | table _time time 

*UPDATED based on comment*

your base search | addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | table dur*

View solution in original post

0 Karma

sundareshr
Legend

Like this

your base search | eval time=strftime(_time, "%H:%M") | table _time time 

*UPDATED based on comment*

your base search | addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | table dur*
0 Karma

chadman
Path Finder

Perfect! That worked great!

0 Karma

chadman
Path Finder

actually displaying this in seconds would work better.

0 Karma

sundareshr
Legend

So you want to display the duration of the search? Are you displaying it in a dashboard?

0 Karma

chadman
Path Finder

So if I do a search from 8AM to 9AM I would like to see the difference in seconds, 3600

0 Karma

sundareshr
Legend

Aha.. see updated answer below..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...