topic calculate difference between 2 dates and times with strftime in Splunk Search

calculate difference between 2 dates and times with strftime

Sfry1981 — Tue, 07 Apr 2020 12:06:28 GMT

I have the below search:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

the evals for start and stop are working fine but the eval for difftime is not working. As I'm using strftime how can i calculate the duration between the 2 dates and times?

Re: calculate difference between 2 dates and times with strftime

richgalloway — Tue, 07 Apr 2020 12:29:12 GMT

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using strptime first. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")

Re: calculate difference between 2 dates and times with strftime

jpolvino — Tue, 07 Apr 2020 12:30:37 GMT

You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

This will give you diffTime in seconds, which you can do with what you want.