Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Calculate difference of fields where certain field value exists

$
0
0
For each Digit I have below (Digit 0,2,3,4,5,7,8) I want to calculate the difference in time between the TXN endtime and the FW endTime for that digit. How can i group this new calculated one value for each digit? index= jobName = (all job names here) | lookup digit_processing.csv jobName as jobName output Digit as Digit | eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S") | table jobName Digit endTime endTimeEpoch status | sort -Digit ![alt text][1] [1]: /storage/temp/282621-capture.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>