Splunk Dev

Query criteria to calculate Time Span

sanjayiowa
New Member

Hi,

Is there a way to calculate a time span from start to stop position using java sdk.

e.g.
11012012 12:00:01 PM Start
...
....

11012012 12:30:01 PM Stop

and
result would be 30 min.

Thanks,
Sanjay

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

If this log file is in Splunk, you could try:

search_foo | transaction host startswith="Start" endswith="Stop"

The resulting "duration" field will tell you how long it took.

http://www.splunk.com/base/Documentation/5.0/SearchReference/Transaction

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

If this log file is in Splunk, you could try:

search_foo | transaction host startswith="Start" endswith="Stop"

The resulting "duration" field will tell you how long it took.

http://www.splunk.com/base/Documentation/5.0/SearchReference/Transaction

dwaddle
SplunkTrust
SplunkTrust

If the answer solved your problem, please click the check box to the left to "accept" the answer.

0 Karma

sanjayiowa
New Member

Thanks for prompt response. I was able to get desire result.

0 Karma

sanjayiowa
New Member

Those events are in a log file. I would like to get 30 min as answer or list of those time period if there are multiple Start/Stop (matching first to first)

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Are you trying to parse this from events returned from a search? Where are you getting these times from?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...