<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to calculate difference between two time stamps in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514967#M87232</link>
    <description>&lt;P&gt;In your AwaitingResponseDate after second it is . (dot) not : (colon) 2020-07-20 18:35:15&lt;STRONG&gt;.&lt;/STRONG&gt;0000000&lt;/P&gt;&lt;P&gt;So your query will be&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S.%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 19 Aug 2020 14:45:03 GMT</pubDate>
    <dc:creator>harsmarvania57</dc:creator>
    <dc:date>2020-08-19T14:45:03Z</dc:date>
    <item>
      <title>How to calculate difference between two time stamps</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514962#M87231</link>
      <description>&lt;P&gt;Hi, I have seen a few post on this subject, but none seem to fix my issue. I am trying to calculate the difference between two date/time stamps.&amp;nbsp;&lt;/P&gt;&lt;P&gt;| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)&lt;BR /&gt;|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S:%7Q")&lt;BR /&gt;|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")&lt;BR /&gt;|eval WaitTime = Start-End&lt;/P&gt;&lt;P&gt;The issue seems to be that the Start field is empty when i add it to a table, however, the End time works. The only difference between start and end is that end is being set by the eval/if statement for CompleteDate because all are null. Start/AwaitingResponseDate is an auto extracted field&amp;nbsp;&lt;/P&gt;&lt;P&gt;The date/time format is the same for each filed. This is an example of the AwaitingResponseDate value&lt;BR /&gt;&lt;SPAN&gt;2020-07-20 18:35:15.0000000&lt;/SPAN&gt;&lt;BR /&gt;This is an example of the inserted CompleteDate field from the same record&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;2020-08-19 09:19:53:0000000&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Any help is certainly appreciated.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 19 Aug 2020 14:31:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514962#M87231</guid>
      <dc:creator>ken_lynch</dc:creator>
      <dc:date>2020-08-19T14:31:11Z</dc:date>
    </item>
    <item>
      <title>Re: How to calculate difference between two time stamps</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514967#M87232</link>
      <description>&lt;P&gt;In your AwaitingResponseDate after second it is . (dot) not : (colon) 2020-07-20 18:35:15&lt;STRONG&gt;.&lt;/STRONG&gt;0000000&lt;/P&gt;&lt;P&gt;So your query will be&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S.%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 19 Aug 2020 14:45:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514967#M87232</guid>
      <dc:creator>harsmarvania57</dc:creator>
      <dc:date>2020-08-19T14:45:03Z</dc:date>
    </item>
    <item>
      <title>Re: How to calculate difference between two time stamps</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514972#M87233</link>
      <description>&lt;P&gt;Thank you so much....it is the little things &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;BR /&gt;Also helps if I use End-Start instead Start-End....&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 19 Aug 2020 14:57:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-difference-between-two-time-stamps/m-p/514972#M87233</guid>
      <dc:creator>ken_lynch</dc:creator>
      <dc:date>2020-08-19T14:57:51Z</dc:date>
    </item>
  </channel>
</rss>

