https://community.splunk.com/t5/Splunk-Search/calculate-duration-on-a-custom-time-stamp/m-p/234846#M176190 <P>try something like:</P> <PRE><CODE>| eval newTime=strptime(timeStr, "%H:%M") </CODE></PRE> <P>to convert the timestamps and then you should be able to use that in an eval to substract timestamps.</P> Tue, 22 Nov 2016 12:54:36 GMT cmerriman 2016-11-22T12:54:36Z https://community.splunk.com/t5/Splunk-Search/calculate-duration-on-a-custom-time-stamp/m-p/234845#M176189 <P>my time stamps are in %H:%M format. one of which is a custom time stamp from my json file. <BR /> is there a way i can calculate the duration with this timestamp</P> Tue, 22 Nov 2016 05:27:53 GMT https://community.splunk.com/t5/Splunk-Search/calculate-duration-on-a-custom-time-stamp/m-p/234845#M176189 twilishyflutter 2016-11-22T05:27:53Z https://community.splunk.com/t5/Splunk-Search/calculate-duration-on-a-custom-time-stamp/m-p/234846#M176190 <P>try something like:</P> <PRE><CODE>| eval newTime=strptime(timeStr, "%H:%M") </CODE></PRE> <P>to convert the timestamps and then you should be able to use that in an eval to substract timestamps.</P> Tue, 22 Nov 2016 12:54:36 GMT https://community.splunk.com/t5/Splunk-Search/calculate-duration-on-a-custom-time-stamp/m-p/234846#M176190 cmerriman 2016-11-22T12:54:36Z