Splunk Search

How can I pull the duration or datetime difference with the given value?

iqbalintouch
Path Finder

I am trying to extract the time duration in tabular format of check-in and check-out value, can someone please help. I am adding these value in my base search query:

index=* sourcetype=* host=* chkin=* chkout=* | eval TimeDifference= chkout-chkin | stats count by chkin,chkout

now there is a field called chkin which indicate the customer check-in date and chkout indicate customer checkout date...now I need to pull the difference of check-in and check-out to identify the stay period of customer ?

I am beginner so don't have much knowledge to use more commands in my search query.

Thanks in advance!

0 Karma

woodcock
Esteemed Legend

It is unlikely that any answer will actually work because you have not shown us sample data but maybe something like this:

index=YouShouldAlwaysSpecifyAnIndex sourcetype=AndSourcetypeToo chkin="*" chkout="*"
| rename COMMENT AS "If both fields are not in each event, total failure happened above"
| eval StayTimeSeconds = chkout - chkin
| rename COMMENT AS "if both values are not 'time_t' integers (AKA 'epoch'), total failure happened above"
| stats avg(StayTimeSeconds) AS AvgStayTime BY host
| eval AvgStayTime=tostring(AvgStayTime, "duration")
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi iqbalintouch,
you have to use the epochtime format before calculate a time diff:

| your_search
| eval TimeDifference=strptime(chkout,"%Y-%m-%d %H:%M:%S")-strptime(chkin,"%Y-%m-%d %H:%M:%S") 
| ...

obviously verify the date format of your chkout and chkin used in strptime.
I don't understand why you want to calculate Time Difference if you don't use it in the following command.
Remember that after Time Difference calculation if you run a stats count like | stats count by chkin,chkout, you don't see Time Difference, to see it you have to add to stats command also the option values(TimeDifference) AS TimeDifference.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...