Dear all,
I'm trying to calculate duration. But what I get returned is off by 2 hours...? I'm using the following:
Search | convert timeformat="%d-%m-%Y %H:%M:%S" mktime(ADCreatedTime) |
convert timeformat="%d-%m-%Y %H:%M:%S" mktime(FIMCreatedTime) |
where ADCreatedTime > FIMCreatedTime |
Eval Duration = ADCreatedTime - FIMCreatedTime |
convert timeformat="%H:%M:%S" ctime(Duration) as D |
convert timeformat="%d-%m-%Y %H:%M:%S" ctime(ADCreatedTime) as ADC |
convert timeformat="%d-%m-%Y %H:%M:%S" ctime(FIMCreatedTime) as FDC |
Table user, FDC, ADC, D
The results are: user FDC ADC D
abiggelaar 25-03-2011 11:02:34 25-03-2011 12:05:49 03:03:15
ahayward 16-02-2011 12:54:59 16-02-2011 13:57:49 03:02:50
beheer.danaher 04-03-2011 09:49:39 04-03-2011 10:53:39 03:04:00
I can't find any time zone stuff going wrong. Can anyone point me in the right direction? Thanks! Wim
The convert that you are doing on Duration
converts the duration into a time based on the epoch. So its saying that Duration is 3 hours 3 minutes 15 seconds from the epoch (for abiggelaar). You want to use an eval tostring evaluation. Replace convert timeformat="%H:%M:%S" ctime(Duration) as D
with eval D=tostring(Duration,"duration")
and it should give you what you want.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions
Problem solved, thanks!
The convert that you are doing on Duration
converts the duration into a time based on the epoch. So its saying that Duration is 3 hours 3 minutes 15 seconds from the epoch (for abiggelaar). You want to use an eval tostring evaluation. Replace convert timeformat="%H:%M:%S" ctime(Duration) as D
with eval D=tostring(Duration,"duration")
and it should give you what you want.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions