topic How do I calculate the difference between these two dates that are not in _time ? in Getting Data In

How do I calculate the difference between these two dates that are not in _time ?

lucasdc — Thu, 23 May 2019 14:29:26 GMT

Hi splunkers!

I have tried to calculate the difference between these two dates (Date Closed) - (Date Created) using eval's , but it's still not working.

I tried to use timestamp as well and I didn't have the results that I want to.

PS** These two fields are not in _time I uploaded the data base as CSV just like in Excel, both are recognized by splunk as strings.

Re: How do I calculate the difference between these two dates that are not in _time ?

koshyk — Thu, 23 May 2019 14:39:12 GMT

Please find attached

|makeresults 
| eval Date_Created="25/3/19 14:45" | eval Date_Closed="3/5/19 15:50" 
| eval Date_Created=strptime(Date_Created,"%e/%m/%y %H:%M")
| eval Date_Closed=strptime(Date_Closed,"%e/%m/%y %H:%M")
| eval timeDiff_secs=Date_Closed-Date_Created

Logic is to convert to epoch time and subtract