topic Re: Time difference in splunk in Splunk ITSI

Time difference in splunk

vijaya5 — Sun, 07 Jun 2020 00:31:58 GMT

I have time stamp like below format
2020-02-17 18:23:04

and i woul like to calculate the differene between two such fields start an end times of an activity. which function i can use to get time difference if the time format is like above?.

Re: Time difference in splunk

gcusello — Wed, 26 Feb 2020 13:51:17 GMT

Hi @vijaya5,
to calculate a difference of two dates/times, you have to transform them in epochtime (using strptime function) then you can caculate the difference:

| eval diff=strptime(time2,"%Y-%m-%d %H:%M:%S")-strptime(time1,"%Y-%m-%d %H:%M:%S")

Ciao.
Giuseppe