Splunk Search

How do you calculate the time in minutes since the latest event, using a manual time entered as a field, not the timestamp?

ltemple1
Engager

Samples are collected and later manually entered into Splunk. I am interested in the time the sample was tested, not when it was uploaded into Splunk. There is a field called Manual Time with the format in "%H:%M:%S %p".

I wrote a search based on other answers that can work using the _time field but it does not seem to work for the ManualTime field.

The following code results in having a ManualTime and nowstring time listed in the same time format.

index="index" sourcetype="sourcetype" 
| stats latest(ManualTime) as ManualTime
| eval timenow=now() 
| eval nowstring=strftime(now(), "%H:%M:%S %p")

Once I add the following code it breaks.

| eval diff = tostring((now() - ManualTime), "duration") 
| table diff

I also need the result to be in the units of minutes (i.e. 75 minutes not 1:15)

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If ManualTime is in string format () then it must be converted to epoch form before you can do any math with it. Try this.

index=index sourcetype=sourcetype
| stats latest(ManualTime) as ManualTime
| eval timenow=now() 
| eval nowstring=strftime(now(), "%H:%M:%S %p") 
| eval eManualTime=strptime(ManualTime,"%H:%M:%S %p") 
| eval diff=round((now()-eManualTime)/60,0)
| table diff
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If ManualTime is in string format () then it must be converted to epoch form before you can do any math with it. Try this.

index=index sourcetype=sourcetype
| stats latest(ManualTime) as ManualTime
| eval timenow=now() 
| eval nowstring=strftime(now(), "%H:%M:%S %p") 
| eval eManualTime=strptime(ManualTime,"%H:%M:%S %p") 
| eval diff=round((now()-eManualTime)/60,0)
| table diff
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...