So I'm trying to display what the timespan is from start to finish of a bucket and add it as a new field to the table.
|dbinspect index=main
| eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S") | eval span=tostring((end_time-start_time), "duration")
| table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount
The problem is that the eval statement that is supposed to calculate span is not functioning correctly, it is just empty for each line. Any thoughts on how I can fix this?
Subtract times using epochs rather than strings. Then convert it into a human-readable format, if desired.
... | eval span=endEpoch-startEpoch | ...
Subtract times using epochs rather than strings. Then convert it into a human-readable format, if desired.
... | eval span=endEpoch-startEpoch | ...
Thanks, that got me there.
|dbinspect index=main
| eval span=tostring((endEpoch-startEpoch), "duration") | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S")
| table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount,splunk_server,path