topic Re: how to subtract two date and time in Getting Data In

how to subtract two date and time

Mohsin123 — Fri, 03 Aug 2018 17:37:35 GMT

Hi ,

I have two date formats

i have to subtract to find the time duratiuon.Can anyone help me convert these to epoch time and then subtract

2018-03-29 10:54:55.0

Regards
Shraddha

Re: how to subtract two date and time

sudosplunk — Tue, 29 Sep 2020 20:43:16 GMT

Hello there,

Assuming you have your timestamps as start_date=2018-03-29 10:54:55.0 end_date=2018-04-29 10:54:55.0

Give this a shot,

your_base search 
     | eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N") 
     | eval end=strptime(end_date, "%Y-%m-%d %H:%M:%S.%N") 
     | eval difference = end - start 
     | table difference

Additionally, have a look at the below links for more details.

https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/DateandTimeFunctions

Re: how to subtract two date and time

somesoni2 — Fri, 03 Aug 2018 18:04:47 GMT

Try like this

your current search with datefield1 and datefield2 which you want to subtract for duration
| eval duration_secs=strptime(datefield2,"%Y-%m-%d %H:%M:%S.%N")-strptime(datefield1,"%Y-%m-%d %H:%M:%S.%N")
| eval duration_str=tostring(duration,"duration")