Splunkers!
I need to compute the duration of a event, as the difference between the two field (END_TIME and OPEN_TIME).
Time format of END_TIME and OPEN_TIME is the following: 2017-12-31-20.01.37.000000
Code is the following:
| eval END_INC=strptime(CLOSE_TIME, "%b %d %Y %H.%M.%S.%3N%P"), BEG_INC=strptime(OPEN_TIME, "%b %d %Y %H.%M.%S.%3N%P")
| eval duration=END_INC - BEG_INC
Not clear how to set parameters in strptime.
Any help?
Tks!
Carmine
A reference on variables you can use when parsing timestamps with strptime
can be found in the docs here: http://docs.splunk.com/Documentation/Splunk/6.6.3/SearchReference/Commontimeformatvariables
In your case you want something like %Y-%m-%d-%H.%M.%S.%6N
.
A reference on variables you can use when parsing timestamps with strptime
can be found in the docs here: http://docs.splunk.com/Documentation/Splunk/6.6.3/SearchReference/Commontimeformatvariables
In your case you want something like %Y-%m-%d-%H.%M.%S.%6N
.
Tks, it works!
Now I got how to use strptime.
Tks Again,
Carmine
Welcome back @Ayn ! It's been a long time 😉
cheers, MuS
PS: you should sign up for slack as well http://docs.splunk.com/Documentation/Community/1.0/community/Chat