topic How to calculate time difference using ctime? in Splunk Search

How to calculate time difference using ctime?

neerajs_81 — Mon, 30 Jan 2023 16:22:16 GMT

Hi All, I have a very simple use case and that is to display the time difference between 2 fields that already have their values as time in epoch format. But when i use ctime to display the difference, it shows weird results.
As shown below my events contains 2 fields ( tt0 & tt1). Their values are timestamp in EPOCH.
If we manually convert these to Human Readable Time , the difference between the tt0 and tt1 is just 03 mins and xx seconds.

tto	tt1
1675061542	1675061732

But when i do a

| eval ttc=tt1-tt0 | convert ctime(ttc)

Splunk displays ttc as follows: 12/31/1969 18:56:49.2304990

What am i doing wrong here? How to make it display ttc correctly ?

Re: Calculate Time difference using ctime

batabay — Mon, 30 Jan 2023 08:39:17 GMT

Hi,

You thinking wrong because you calculate difference field.

Try This ;

| makeresults | eval tt0=relative_time(now(),"-10m@m"), tt1=now() | eval diff = tt1 - tt0 | eval diff = tostring(diff,"duration")

Re: Calculate Time difference using ctime

ITWhisperer — Mon, 30 Jan 2023 08:39:31 GMT

Try using tostring() with "duration"

| eval ttc=tt1-tt0 | fieldformat ttc=tostring(ttc,"duration")

Re: Calculate Time difference using ctime

neerajs_81 — Mon, 30 Jan 2023 08:46:04 GMT

Didn't understand what you meant by thinking wrong you calculate difference field ? R you saying i need to use eval twice for the difference field ?

Re: Calculate Time difference using ctime

neerajs_81 — Mon, 30 Jan 2023 09:47:43 GMT

@ITWhisperer i have seen in lot of your posts you recommending ctime instead of strftime/strptime. Is there a reason that you prefer ctime ?
Thanks

Re: Calculate Time difference using ctime

ITWhisperer — Mon, 30 Jan 2023 09:55:56 GMT

That surprises me as I thought I preferred strftime()!