Hi
I am having an issue with the result of my dur2sec function not displaying.
Here is the SPL. I am still new to splunk so have put what I believe I am doing alongside the query.
|eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") -- convert the ENTRY field date string to a proper date format
|eval dwellTime_S = tostring(now()-Entrytimestamp,"duration") -- get the duration string and assign it to variable dwellTime_S
|convert dur2sec(dwellTime_S) AS dwellTime_C -- convert the dwellTime string variable to seconds and assign to dwellTime_C variable
When i then use the dwellTime_C in a table the column is blank. Please can anyone help and advise where I am going wrong ?
Many Thanks
PS: I am not in the office tomorrow so wont be able to reply immediately.
↧