https://community.splunk.com/t5/Getting-Data-In/Convert-date-string-to-timestamp/m-p/538506#M90243 <P>Hi,</P><P>I have a field called datetime - example is datetime=Wed Feb 03 17:56:37 UTC 2021</P><P>I essentially want to convert this so I can evaluate the difference between the event timestamp with this datetime field. I have already converted the event timestamp using: | eval input=strptime(_time, "%m/%d/%Y %I:%M %p") ---&gt; this would show me 2021-02-03 18:07:42.958</P><P>How do I convert the datetime field so it's in the same format and how to show the difference between these fields?</P> Wed, 03 Feb 2021 18:30:23 GMT Master162 2021-02-03T18:30:23Z https://community.splunk.com/t5/Getting-Data-In/Convert-date-string-to-timestamp/m-p/538506#M90243 <P>Hi,</P><P>I have a field called datetime - example is datetime=Wed Feb 03 17:56:37 UTC 2021</P><P>I essentially want to convert this so I can evaluate the difference between the event timestamp with this datetime field. I have already converted the event timestamp using: | eval input=strptime(_time, "%m/%d/%Y %I:%M %p") ---&gt; this would show me 2021-02-03 18:07:42.958</P><P>How do I convert the datetime field so it's in the same format and how to show the difference between these fields?</P> Wed, 03 Feb 2021 18:30:23 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-date-string-to-timestamp/m-p/538506#M90243 Master162 2021-02-03T18:30:23Z https://community.splunk.com/t5/Getting-Data-In/Convert-date-string-to-timestamp/m-p/538514#M90245 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231175">@Master162</a>,</P><P>Please try this;</P><LI-CODE lang="markup">| eval datetime_epoc=strptime(datetime,"%a %b %d %H:%M:%S %Z %Y") | eval diff=_time-datetime_epoc</LI-CODE> Wed, 03 Feb 2021 20:10:33 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-date-string-to-timestamp/m-p/538514#M90245 scelikok 2021-02-03T20:10:33Z