https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513493#M87079 <P>|eval diff = target.received.end.timestamp - target.received.start.timestamp&nbsp;</P> Tue, 11 Aug 2020 04:28:32 GMT to4kawa 2020-08-11T04:28:32Z https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513490#M87078 <P>I want the difference between two timestamps in epoch.</P><P>My fields are like:</P><TABLE width="368px"><TBODY><TR><TD width="232px"><A href="https://rpdata-corelogic.splunkcloud.com/en-GB/app/search/search?q=search%20index%3D%22apigee%22%20apiproxy%3D%22property-detail%22%20apigee_env%3Dprod%203480017%20%20%7Crename%20%22client.received.end.timestamp%22%20as%20endTime%20%7C%20eval%20epochA%3Dstrptime(%27endTime%27%2C%20%22%25b%20%25d%20%25Y%20%25H%3A%25M%3A%25S%22)%2B3600&amp;display.page.search.mode=smart&amp;dispatch.sample_ratio=1&amp;earliest=-30m%40m&amp;latest=now&amp;sid=1597117025.1207954#" target="_blank" rel="noopener"><SPAN>target.received.end.timestamp</SPAN></A></TD><TD width="136px"><A href="https://rpdata-corelogic.splunkcloud.com/en-GB/app/search/search?q=search%20index%3D%22apigee%22%20apiproxy%3D%22property-detail%22%20apigee_env%3Dprod%203480017%20%20%7Crename%20%22client.received.end.timestamp%22%20as%20endTime%20%7C%20eval%20epochA%3Dstrptime(%27endTime%27%2C%20%22%25b%20%25d%20%25Y%20%25H%3A%25M%3A%25S%22)%2B3600&amp;display.page.search.mode=smart&amp;dispatch.sample_ratio=1&amp;earliest=-30m%40m&amp;latest=now&amp;sid=1597117025.1207954#" target="_blank" rel="noopener">1597115254203</A></TD></TR></TBODY></TABLE><TABLE><TBODY><TR><TD><A href="https://rpdata-corelogic.splunkcloud.com/en-GB/app/search/search?q=search%20index%3D%22apigee%22%20apiproxy%3D%22property-detail%22%20apigee_env%3Dprod%203480017%20%20%7Crename%20%22client.received.end.timestamp%22%20as%20endTime%20%7C%20eval%20epochA%3Dstrptime(%27endTime%27%2C%20%22%25b%20%25d%20%25Y%20%25H%3A%25M%3A%25S%22)%2B3600&amp;display.page.search.mode=smart&amp;dispatch.sample_ratio=1&amp;earliest=-30m%40m&amp;latest=now&amp;sid=1597117025.1207954#" target="_blank" rel="noopener"><SPAN>target.received.start.timestamp</SPAN></A></TD><TD><A href="https://rpdata-corelogic.splunkcloud.com/en-GB/app/search/search?q=search%20index%3D%22apigee%22%20apiproxy%3D%22property-detail%22%20apigee_env%3Dprod%203480017%20%20%7Crename%20%22client.received.end.timestamp%22%20as%20endTime%20%7C%20eval%20epochA%3Dstrptime(%27endTime%27%2C%20%22%25b%20%25d%20%25Y%20%25H%3A%25M%3A%25S%22)%2B3600&amp;display.page.search.mode=smart&amp;dispatch.sample_ratio=1&amp;earliest=-30m%40m&amp;latest=now&amp;sid=1597117025.1207954#" target="_blank" rel="noopener">1597115254203</A></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>So need the difference between end and start timestamp.</P><P>Any help would be helpful.</P><P>&nbsp;</P><P>Thanks</P> Tue, 11 Aug 2020 03:41:51 GMT https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513490#M87078 smahuja 2020-08-11T03:41:51Z https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513493#M87079 <P>|eval diff = target.received.end.timestamp - target.received.start.timestamp&nbsp;</P> Tue, 11 Aug 2020 04:28:32 GMT https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513493#M87079 to4kawa 2020-08-11T04:28:32Z https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513496#M87080 <P>And in human readable format</P><P>| eval diffHuman = tostring(diff, “duration”)</P><P>r. Ismo</P> Tue, 11 Aug 2020 04:47:59 GMT https://community.splunk.com/t5/Getting-Data-In/epoch-time/m-p/513496#M87080 isoutamo 2020-08-11T04:47:59Z