# How calculed Uptime in Kibana

**URL:** <https://discuss.elastic.co/t/how-calculed-uptime-in-kibana/262486>\
**Category:** Kibana\
**Created:** [January 28, 2021, 11:15am UTC](https://discuss.elastic.co/t/how-calculed-uptime-in-kibana/262486 "2021-01-28T11:15:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ITchandj](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@ITchandj](https://discuss.elastic.co/u/ITchandj)\
**Post date:** [January 28, 2021, 11:15am UTC](https://discuss.elastic.co/t/how-calculed-uptime-in-kibana/262486/1 "2021-01-28T11:15:01Z")

</div>

Hallo everyone. I need heep in kibana. I want to write one Scripted field that converts Sessionlogontime(string) and gives me the result per day. i would be very proud if someone can offer me a solution. It is calculated like this in splunk

latest(SessionLogonTime) as BootTime  
latest(HwModel) as HwModel  
splitrow  
host as Host  
filter host in ("\*")

```
     | eval BootTime = strptime (BootTime,"%Y-%m-%d %H:%M:%S.%Q %z")
     | eval Uptime = round ((now() - BootTime) / 86400, 2)
     | stats
        avg(Uptime) as AvgUptime
        dc(Host) as "#Hosts"
        by HwModel
     | rename HwModel as "Hardware model"
     | eval "Avg. uptime (days)" = round (AvgUptime, 1) | sort - "Avg. uptime (days)"
```

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [January 28, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-calculed-uptime-in-kibana/262486/2 "2021-01-28T17:49:12Z")

</div>

I'm not familiar with splunk, so maybe I'm missing some parts of your question. There is an important difference in the way you're asking your question vs how I think about the question: the ELK stack is optimized for _fast performance on pre-indexed data_, and so it will be slower if you want to calculate something that isn't pre-indexed.

So basically my recommendation is, if you can, you should be indexing "uptime" as a numeric field.

If you can't, then you still have options, but there are tradeoffs:

1. Use the Elasticsearch transforms to find duration, [like this example](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-painless-examples.html#painless-bucket-script)
2. Don't calculate durations on the client-side, but use the [top hits metric](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html) to find the "latest value" per status

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-calculed-uptime-in-kibana/262486/3 "2021-02-25T17:49:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.