https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373615#M109866 <P>thanks @xpac! This work for me as well but I didn't use the |make results <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 02 May 2018 23:32:01 GMT auaave 2018-05-02T23:32:01Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373609#M109860 <P>Hi Guys,</P> <P>I have the below time formats that I converted to epoch to get the difference. <BR /> START - "04-30-2018 16:17:09"<BR /> END - "2018-04-30 16:17:19.072"</P> <P>I used the below query but the difference/ duration doesn't display properly. It displays 10:00:10 instead of 00:00:10, 10:10:10 instead of 00:10:10. How can I fix this? Thanks!</P> <P>| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=strftime(DURATION, "%H:%M:%S")</P> Wed, 02 May 2018 13:20:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373609#M109860 auaave 2018-05-02T13:20:44Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373610#M109861 <P>Can you try :</P> <PRE><CODE>| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=tostring(DURATION, "duration") </CODE></PRE> Wed, 02 May 2018 13:27:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373610#M109861 p_gurav 2018-05-02T13:27:03Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373611#M109862 <P>You should do the <CODE>DURATION</CODE> math before converting to string format time.</P> <PRE><CODE>|eval DURATION=('end'-'start') | eval DURATION=strftime(DURATION, "%H:%M:%S") |table start end DURATION </CODE></PRE> Wed, 02 May 2018 13:29:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373611#M109862 skoelpin 2018-05-02T13:29:27Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373612#M109863 <P>Hey,</P> <P>try this:</P> <PRE><CODE>| makeresults | eval START="04-30-2018 16:17:09" | eval END="2018-04-30 16:17:19.072" | eval end=strptime(END,"%Y-%m-%d %H:%M:%S") | eval start=strptime(START,"%m-%d-%Y %H:%M:%S") | eval DURATION=(end-start) | table start end DURATION | fieldformat DURATION=tostring(DURATION, "duration") | eval DURATION=replace(DURATION, "\.000000", "") </CODE></PRE> <P>Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 02 May 2018 13:35:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373612#M109863 xpac 2018-05-02T13:35:08Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373613#M109864 <P>Thank you @ p_gurav! This works for me <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 02 May 2018 23:29:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373613#M109864 auaave 2018-05-02T23:29:56Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373614#M109865 <P>Thanks @skoelpin, I tried this but still got the 10: in front. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Wed, 02 May 2018 23:30:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373614#M109865 auaave 2018-05-02T23:30:41Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373615#M109866 <P>thanks @xpac! This work for me as well but I didn't use the |make results <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 02 May 2018 23:32:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373615#M109866 auaave 2018-05-02T23:32:01Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373616#M109867 <P>The <CODE>makeresults</CODE> part is only used to create fake events because we don't have your data available <span class="lia-unicode-emoji" title=":winking_face:">😉</span><BR /> Happy it worked out for you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 03 May 2018 00:10:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-H-M-S/m-p/373616#M109867 xpac 2018-05-03T00:10:11Z