https://community.splunk.com/t5/Splunk-Search/Dealing-with-Datetime-in-Splunk-Henny/m-p/549665#M155984 <P>Hello respected members of the prestigious forum of Splunk<BR /><BR />I have been working with datetimes in splunk and it is making me insane... I am extracting the datetime of two separate events to later on subtract them, I have tried many ways to achieve this but I still dont have the results that I want... the format of datetime of the events look like this:&nbsp; <SPAN>2020-07-28T09:42:33-06:00 I want to be able to have calculate difference in minutes between to events "join" by the field: error-code... Because of the way the system is configured the error "adult.mov" may appear twice or three times but I am only interested in the first time it appeared ... However, if this error has not appeared yet I want to record the current time instead... I am trying something like this:</SPAN></P><P>&nbsp;</P><LI-CODE lang="markup">| eval terrorXYU=if(match(_raw, "e_type_k"),datetime_c, null) | eval terroradult.mov=if(match(_raw, "mov"),datetime_c, null) | eval terroradult.mov= strptime(terroradult.mov,"%m/%d/%Y %H:%M:%S:%3N") | eval terrorXYU= strptime(terrorXYU,"%m/%d/%Y %H:%M:%S:%3N") | eval diff= terroradult.mov-terrorXYU</LI-CODE><P>&nbsp;</P><P>but I get nothing ins return I have tried a most of the codes in other posts but no luck at all.. thank you for helping me indeed</P> Wed, 28 Apr 2021 17:08:02 GMT andres91302 2021-04-28T17:08:02Z https://community.splunk.com/t5/Splunk-Search/Dealing-with-Datetime-in-Splunk-Henny/m-p/549665#M155984 <P>Hello respected members of the prestigious forum of Splunk<BR /><BR />I have been working with datetimes in splunk and it is making me insane... I am extracting the datetime of two separate events to later on subtract them, I have tried many ways to achieve this but I still dont have the results that I want... the format of datetime of the events look like this:&nbsp; <SPAN>2020-07-28T09:42:33-06:00 I want to be able to have calculate difference in minutes between to events "join" by the field: error-code... Because of the way the system is configured the error "adult.mov" may appear twice or three times but I am only interested in the first time it appeared ... However, if this error has not appeared yet I want to record the current time instead... I am trying something like this:</SPAN></P><P>&nbsp;</P><LI-CODE lang="markup">| eval terrorXYU=if(match(_raw, "e_type_k"),datetime_c, null) | eval terroradult.mov=if(match(_raw, "mov"),datetime_c, null) | eval terroradult.mov= strptime(terroradult.mov,"%m/%d/%Y %H:%M:%S:%3N") | eval terrorXYU= strptime(terrorXYU,"%m/%d/%Y %H:%M:%S:%3N") | eval diff= terroradult.mov-terrorXYU</LI-CODE><P>&nbsp;</P><P>but I get nothing ins return I have tried a most of the codes in other posts but no luck at all.. thank you for helping me indeed</P> Wed, 28 Apr 2021 17:08:02 GMT https://community.splunk.com/t5/Splunk-Search/Dealing-with-Datetime-in-Splunk-Henny/m-p/549665#M155984 andres91302 2021-04-28T17:08:02Z