how to calculate duration between two events Splunk

Question

I need to find the duration between two events. I went over the solutions on splunk and Stack Overflow, but still can't get the calculation.

Both sentToSave and SaveDoc have the time stamp already formatted, which is why I used the case function. I am able to see the fields populate with their time stamps, but I am not able to get the Duration field to populate the duration - it simply does not populate at all.

Need some help on how to get the Duration - any advice? Here is my search:

(index=souce1 dept=qvc event="sentToSave") OR (index=source dept=save area=saveDoc)
| eval saveDocTime=case(area="saveDoc", TimeStamp), sentToSaveTime=case(event="sentToSave", TimeStamp)
| eval Duration=saveDocTime-sentToSaveTime
| stats values(Duration) as Duration earliest(sentToSaveTime) as sentToSaveTime latest(saveDocTime) as saveDocTime  by emailRequest
| where isNotNull(sentToSaveTime) AND isNotNull(saveDocTime)

Could you please add sample events to your question? – Anant Naugai Apr 01 '21 at 03:47 — Anant Naugai, Apr 01 '21 at 03:47

score 3 · Answer 1 · edited Apr 01 '21 at 13:14

3

Timestamps must be in integer (epoch) form to be compared. Use the strptime function to convert them from strings to integers and then you can subtract them.

As @Anant Naugai said, if you provide some sample events then we can be more specific.

edited Apr 01 '21 at 13:14

warren

32,620
21
85
124

answered Apr 01 '21 at 07:35

RichG

9,063
2
18
29

score 2 · Answer 2 · answered Apr 05 '21 at 02:59

The reason Duration is not populating, I suspect without data, is that the saveDocTime and sentToSaveTime fields are from different events. (Your first line implies as much with different indexes).

Since eval works on each result in parallel, Duration as it is currently calculated will always be undefined since you are always trying to perform a calculation with a value that doesn't exist (one or the other depending on which kind of event it's attempting.

Now your stats event pulls the fields together into a single event for each emailRequest. So if you move your eval for calculating Duration to after the stats command you'll have a duration.

how to calculate duration between two events Splunk

2 Answers2

Linked