topic Re: Subtracting two timestamps returning incorrect difference? in Getting Data In

Subtracting two timestamps returning incorrect difference?

xoamanda12xo — Fri, 20 Aug 2021 18:15:00 GMT

I am using the splunk field: _time and subtracting my own time field: open_date from the time field. The goal is to get the difference between these two time stamps. For example, one entry in the _time field is: "2021-03-11 11:17:13" and one entry in the open_date field is: "2021-06-07T14:50:42".

I am running the current query operations:

| eval difference = abs(_time - strptime(open_date, "%Y-%m-%dT%H:%M:%S")) | eval difference = strftime(difference,"%Y-%m-%dT%H:%M:%S")

When running this for the above example entries I get a difference output of "1970-03-29T20:10:19", which is obviously incorrect. What am I doing wrong and how can I get the correct difference between these two fields?

Re: Subtracting two timestamps returning incorrect difference?

astackpole — Fri, 20 Aug 2021 18:45:28 GMT

I would try this:

| eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S") | eval open_date = (strptime(open_date, "%Y-%m-%dT%H:%M:%S") | eval diff = abs(mytime - open_date) | eval difference = strftime(diff,"%Y-%m-%dT%H:%M:%S")

When you call the _time variable by default it is in UTC so you need to format both fields before running the final equation. Please upvote if this helps! 🙂

Re: Subtracting two timestamps returning incorrect difference?

xoamanda12xo — Fri, 20 Aug 2021 19:05:17 GMT

That didn't return any results for me 😞

Re: Subtracting two timestamps returning incorrect difference?

astackpole — Fri, 20 Aug 2021 20:58:48 GMT

Try this! Using now() instead of _time works a lot better from my experience. I was able to test this too so let me know if this works for you then!

Here's another Splunk Answer I found that may be helpful too! https://community.splunk.com/t5/Splunk-Search/Compare-a-date-field-with-current-date/m-p/65056