https://community.splunk.com/t5/Getting-Data-In/time-difference-issues/m-p/40929#M7592 <P>I need to be able to calculate the time difference between two dates and everytime i try anything...it returns blank<BR /> my search looks like this...<BR /> StartTime ResolvedTime<BR /> 11/1/2012 9:35:45 AM 11/3/2012 9:35:45 AM</P> <P>All i want to do is have the search return a result with the time difference between StartTime and ResolvedTime. So basically TimeToResolve should be 48 hours, 0 minutes, 0 seconds.</P> <P>Please Help me...</P> <P>Thanks </P> Fri, 22 Feb 2013 21:01:03 GMT testAnalysis 2013-02-22T21:01:03Z https://community.splunk.com/t5/Getting-Data-In/time-difference-issues/m-p/40929#M7592 <P>I need to be able to calculate the time difference between two dates and everytime i try anything...it returns blank<BR /> my search looks like this...<BR /> StartTime ResolvedTime<BR /> 11/1/2012 9:35:45 AM 11/3/2012 9:35:45 AM</P> <P>All i want to do is have the search return a result with the time difference between StartTime and ResolvedTime. So basically TimeToResolve should be 48 hours, 0 minutes, 0 seconds.</P> <P>Please Help me...</P> <P>Thanks </P> Fri, 22 Feb 2013 21:01:03 GMT https://community.splunk.com/t5/Getting-Data-In/time-difference-issues/m-p/40929#M7592 testAnalysis 2013-02-22T21:01:03Z https://community.splunk.com/t5/Getting-Data-In/time-difference-issues/m-p/40930#M7593 <PRE><CODE>| convert timeformat="%m/%e/%Y %I:%M:%S %p" mktime(StartTime) AS StartTime_epoch mktime(ResolvedTime) AS ResolvedTime_epoch | eval age=round((ResolvedTime_epoch-StartTime_epoch)/60/60/24) </CODE></PRE> Fri, 22 Feb 2013 21:42:22 GMT https://community.splunk.com/t5/Getting-Data-In/time-difference-issues/m-p/40930#M7593 carmackd 2013-02-22T21:42:22Z