topic Re: How to subtract two time fields? in Splunk Search

How to subtract two time fields?

cotyp — Wed, 14 Feb 2018 17:34:00 GMT

How would I go about subtracting EndTime from BeginTime?

Re: How to subtract two time fields?

493669 — Wed, 14 Feb 2018 17:42:12 GMT

Try this run anywhere search:

|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")|eval days=round((EndTime-BeginTime)/86400)

Re: How to subtract two time fields?

adonio — Wed, 14 Feb 2018 17:45:00 GMT

hello there,
try this:

... your search ...
|eval end_time_epoch = strptime(EndTime, "%m/%d/%Y %H:%M:%S")
|eval begin_time_epoch = strptime(BeginTime, "%m/%d/%Y %H:%M:%S")
| eval duration = end_time_epoch - begin_time_epoch

hope it helps

Re: How to subtract two time fields?

cotyp — Wed, 14 Feb 2018 20:38:35 GMT

how would you go about getting results in minutes?

Re: How to subtract two time fields?

cotyp — Wed, 14 Feb 2018 20:39:09 GMT

How would I make the epoch time human readable? Results to display in a manner such as, 8d 15 hrs 20 minutes?

Re: How to subtract two time fields?

adonio — Wed, 14 Feb 2018 21:20:28 GMT

try this at the end of your query:

  | eval "duration_Days+HHMMSS" = tostring(duration, "duration")

Re: How to subtract two time fields?

493669 — Thu, 15 Feb 2018 03:02:47 GMT

to get results in min divide the difference(in sec.) by 60

...|eval minutes=round((EndTime-BeginTime)/60)

Re: How to subtract two time fields?

493669 — Thu, 15 Feb 2018 03:30:00 GMT

if you want duration in day hr and min then try this run anywhere search:

|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")| eval stringSecs = tostring((EndTime-BeginTime), "duration")| eval stringSecss = replace(stringSecs,"(\d+)\+(\d+)\:(\d+)\:.*","\1d \2h \3min ")

Re: How to subtract two time fields?

cotyp — Thu, 15 Feb 2018 14:13:12 GMT

thank you!

Re: How to subtract two time fields?

493669 — Thu, 15 Feb 2018 14:16:57 GMT

Glad to help you:) Please accept the answer as well.