Splunk Search

Unable to calculate a difference after using mvindex with _time field

tewarbit
New Member

I am using a transaction to combine events and I want to calculate the difference in time between the two events. I am getting a "Typechecking failed. '-' only takes numbers" error when trying to do subtraction on the _time field. Is there a way to do this?
Here is my search:

"Starting task" OR "Terminating task"
| eval myTime = _time 
| transaction pid 
| eval duration = mvindex(myTime, 1)-mvindex(myTime, 0), startTime = strftime(mvindex(myTime, 0), "%m/%d/%Y %H:%M:%S"), endTime = strftime(mvindex(myTime, 1), "%m/%d/%Y %H:%M:%S") 
| table pid startTime endTime duration

***Edit*
Responding to grittonc's question:
Yes - I am certain myTime is multi-valued. I can properly see the startTime and endTime values populating correctly in my table. Also - here is a snippet of the combined event:
alt text

0 Karma
1 Solution

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

View solution in original post

0 Karma

grittonc
Contributor

You either need to calculate the epoch time start and end first, or add tonumber() to convert them to numbers:

| eval end=mvindex(myTime, 1), start=mvindex(myTime, 0), duration = end-start

OR

|eval duration=tonumber(mvindex(myTime, 1))-tonumber(mvindex(myTime, 0))

0 Karma

tewarbit
New Member

Both ways worked perfectly. Thanks!

0 Karma

grittonc
Contributor

Are you sure that you are ending up with a multi-value field called myTime? Can you post sample data, anonymized if necessary?

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...