Splunk Search

How to turn string value into a time value to calculate the difference between two fields?

tonahoyos
Explorer

Hello,

I have a log that when uploaded to SPLUNK this appears as a string even though it should be in time format. So, I have to convert this string into a time in order to calculate the difference between an end time and a start time. This is my code:

| eval StartTimestamp=strptime(StartTime,"%d/%m/%Y %H:%M:%S"), ActualTimestamp=strptime(ActualAlarmTime,"%d/%m/%Y %H:%M:%S") 
| eval ResponseTimestamp= (StartTimestamp-ActualTimestamp)
| stats avg(ResponseTimestamp) as ResponseTime

It is not creating any errors, but I am not sure if the answer is in seconds or in an epoch format. I would like to see the ResponseTime in a %H:%M:%S format.

Thanks!

0 Karma
1 Solution

Vijeta
Influencer

You can convert the Response Timestamp into "%d/%m/%Y %H:%M:%S" format or just "%H:%M:%S" format using strftime

eval ResponseTime=strftime(ResponseTime,"%d/%m/%Y %H:%M:%S")   

Or you can use

eval ResponseTime=strftime(ResponseTime,"%H:%M:%S")

View solution in original post

0 Karma

493669
Super Champion

Try below-
it will convert epoch time in seconds into required readable format using strftime

|eval ResponseTimestamp=strftime(ResponseTimestamp,"%H:%M:%S")
0 Karma

Vijeta
Influencer

You can convert the Response Timestamp into "%d/%m/%Y %H:%M:%S" format or just "%H:%M:%S" format using strftime

eval ResponseTime=strftime(ResponseTime,"%d/%m/%Y %H:%M:%S")   

Or you can use

eval ResponseTime=strftime(ResponseTime,"%H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...