Splunkers,
I have events from our Helpdesk ticketing system that have two date fields, DateOpen and DateClosed, both with the following format:
2013-02-25 12:50
2013-02-26 12:58
I am trying to write a report that shows average time from when the ticket was opened and when it was closed. Based on research, i think i need to convert these to epoch time using mktime and then do the subtraction, then convert back to ctime. Unfortunately, i cant get mktime to return any values.
convert timeformat="%y/%m/%d %H-%M" mktime(DateClosed) AS closedon_epoch | table DateClosed, closedon_epoch
Am i missing something here or am i going about this the wrong way? Thanks in advance for any help.
strptime is the way i'd do it ...
... | eval open_epoch=strptime(DateOpen,"%Y-%m-%d %H:%M")
| eval close_epoch=strptime(DateClosed,"%Y-%m-%d %H:%M")
| eval duration=tostring(close_epoch-open_epoch,"duration")
| ...
strptime is the way i'd do it ...
... | eval open_epoch=strptime(DateOpen,"%Y-%m-%d %H:%M")
| eval close_epoch=strptime(DateClosed,"%Y-%m-%d %H:%M")
| eval duration=tostring(close_epoch-open_epoch,"duration")
| ...
Perfect, thanks!!!