Splunk Search

How to edit my search to calculate the difference between two timestamps in the same event?

pkurt
Path Finder

Hello,

I am trying to determine the time difference between the two timeStamp columns in my events.
I tried to use the search below, but cannot return anything for the "diff" at the end...

 ... my base search ... | eval raw_time=strptime(_time,'%Y-%m-%dT%H:%M:%S')  | eval utc_endtime=strptime(UTC_EndTime,'%Y-%m-%dT%H:%M:%S') | eval diff= raw_time-utc_endtime

My example events are like this:

2016-10-15T03:59:59.999999, UTC_EndTime=2016-10-14T19:59:59.999999,
2016-10-15T02:59:59.999999, UTC_EndTime=2016-10-14T18:59:59.999999,
2016-10-15T01:59:59.999999, UTC_EndTime=2016-10-14T17:59:59.999999,

I would appreciate if you can help me to see the mistake I am doing here.

Many thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.

  ... my base search ...   | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.

  ... my base search ...   | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime
0 Karma

pkurt
Path Finder

it worked, thank you very much!

0 Karma

cmerriman
Super Champion

Use convert.

  ... my base search ... | Convert mktime(_time) as raw_time timestamp="%Y-%m-%dT%H:%M:%S" | Convert mktime(UTC_EndTime) as utc_endtime "%Y-%m-%dT%H:%M:%S"| eval diff= raw_time-utc_endtime
0 Karma

pkurt
Path Finder

I could not make this work. Thank you very much though!

0 Karma

sundareshr
Legend

Change single quotes ' to double quotes "

| eval raw_time=strptime(_time,"%Y-%m-%dT%H:%M:%S")  | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S") | eval diff= raw_time-utc_endtime
0 Karma

pkurt
Path Finder

Thank you very much. Double quotes are not the issue. It works only if I add ".%N" to my time string since the actual timeStamp has ".999999" component.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...