topic Re: epoch time subraction gives negative values in Splunk Search

epoch time subraction gives negative values

kishen2017 — Tue, 29 Sep 2020 18:32:37 GMT

Subtracting two timestamps results in negative values. Using epoch time to find the differences between two timestamp but the results comes in negative values.

index=npp_pe_sumidx_slr003 | streamstats values(Time5) as new, values(Time6) as old | eval duration2=new-old | table new old duration2

   T1                               T2                           Diff

1521470540.030000 1521470540.290000 -0.260000
1521470596.110000 1521470596.360000 -0.250000
1521470620.090000 1521470620.310000 -0.220000
1521470588.020000 1521470588.240000 -0.220000

Re: epoch time subraction gives negative values

richgalloway — Tue, 20 Mar 2018 02:08:41 GMT

Are you sure you have the fields in the correct order? Perhaps Time5 is old and Time6 is new?

Re: epoch time subraction gives negative values

kishen2017 — Tue, 20 Mar 2018 02:20:02 GMT

Hi richgalloway,

Timestamp order is correct. Time5 is new and Time6 is old and we want to subtract Time5 - Time6 only. This negative results not coming for all the events..only for specfic events we are getting the negative values. those negative values are updated in ticket

Regards,
Krishna

Re: epoch time subraction gives negative values

richgalloway — Tue, 20 Mar 2018 03:24:32 GMT

Have you verified the values of Time5 and Time6 are the same as what your ticketing system says? If you just need to make sure you don't get a negative value for duration2 use ... | eval duration2=abs(new-old) | ...

Re: epoch time subraction gives negative values

niketn — Tue, 20 Mar 2018 06:20:45 GMT

@kishen2017, the negaive difference in the above example look correct to me.

1521470540.290000 (T2) > 1521470540.030000 (T1). If you compare 29 > 03 and difference is 26. Since you are performing T1-T2 you are expected to get negative values. So you should perform T2-T1 as per your data.

Re: epoch time subraction gives negative values

nanosam — Fri, 05 Feb 2021 15:39:22 GMT

Hi kishen,

did you find the a solution for your problem? I struggle with the same problem at my calculation.

nanosam