I have a event, where starttime and endtime are coming as string. I am using below query.
.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | eval Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration
With help of this query, I am able to get the right value for Start and End time, but duration is coming 00:00 as both time are in different format. I Tried to convert both time in same format using convert function but getting blank value.
.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | convert ctime(Start_Time) | convert ctime(End_Time) | eval Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration
Can anyone help me to get the difference of Start and End time.
Thanks in advance.
Please convert End_Time to epoch time and calculate Duration.
eval End_Time=strptime(End_Time,"your format")
> | convert ctime(Start_Time) | convert ctime(End_Time)
ctime needs an epoch time. Strings can not be used.
> |eval Start_Time=strftime(_time, "%H:%M;%S")
Start_Time:String
_time:epoch time
If duration is 00:00, check the _time of the transaction start and end logs.
I tried to convert format for End_Time but getting blank value for that field. I used below query now.
... "Start time for " |eval Start_Time=strftime(_time, "%H:%M:%S") |sort -Start_Time | table Start_Time | appendcols [ search ..... "End time for " |eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strftime(End_Time, "%H:%M:%S") | eval Duration= End_Time
-Start_Time |sort -End_Time | table End_Time ] | table Start_Time End_Time Duration
Please show me sample log.
|eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strftime(End_Time, "%H:%M:%S")
|eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strptime(End_Time, "%H:%M:%S")
However, because it is 9 digits, the format is different
"%H:%M:%S"->00:00:00 (8 digits)