https://community.splunk.com/t5/Splunk-Search/How-to-get-Uptime-in-Days/m-p/585540#M204008 <P>My output format is&nbsp;<SPAN><STRONG>20220129054235</STRONG>.496380-300<BR /><BR /></SPAN>I need to convert the value in bold to normal and find the difference of that to now() ie., epoch time.&nbsp; this will give the uptime in days<BR /><BR /><BR /></P> Thu, 17 Feb 2022 16:14:32 GMT priya1926 2022-02-17T16:14:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-Uptime-in-Days/m-p/585540#M204008 <P>My output format is&nbsp;<SPAN><STRONG>20220129054235</STRONG>.496380-300<BR /><BR /></SPAN>I need to convert the value in bold to normal and find the difference of that to now() ie., epoch time.&nbsp; this will give the uptime in days<BR /><BR /><BR /></P> Thu, 17 Feb 2022 16:14:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-Uptime-in-Days/m-p/585540#M204008 priya1926 2022-02-17T16:14:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-Uptime-in-Days/m-p/585544#M204011 <P>Hi</P><P>here is one way</P><LI-CODE lang="markup">| makeresults | eval time="20220129054235.496380-300" | eval epoch = strptime(time, "%Y%m%d%H%M%S.%6Q%z") | eval time2 = strftime(epoch, "%F %T") | eval UpTime = tostring(round(now()-epoch), "duration")</LI-CODE><P>If you want to calculate with UpTime then you need to convert it by yourself as usually to get days, hours, mins and seconds from it.</P><P>r. Ismo&nbsp;</P> Thu, 17 Feb 2022 12:04:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-Uptime-in-Days/m-p/585544#M204011 isoutamo 2022-02-17T12:04:43Z