Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Unable to find the difference in time between two events. What am I doing wrong?

$
0
0
Hello, I am trying to report on the differences in time between two events. To do so seems straightforward enough. Take eventA = _time (of event A) eventB = _time (of event B) TimeDifference = strftime((EpochTime(event A) - EpochTime(event B)) , "%H:%M:%S") The time between events occurs pretty reliably every 30 minutes or so, as reflected in the logs. Yet, in my reports, I'm getting values like 30 hours. My first assumption would be that I mixed the Hours and Minutes up, but I haven't. Is there something wrong with my approach for finding the time difference? I am baffled. Thanks for your time.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>