https://community.splunk.com/t5/Splunk-Search/time-difference-between-two-fields/m-p/678484#M232018 <P>Hi,</P> <P>I have two fields, where time zone seems to be different.. please could you help me to get difference ?&nbsp;</P> <P>itime=&nbsp;<SPAN>2024-02-22 20:56:02,185</SPAN></P> <P>stime=<SPAN>2024-02-23T01:56:02Z</SPAN></P> <P>I tried the below but it always gives around 5 hrs delay..</P> <P>SPL:</P> <LI-CODE lang="markup">| eval itime=strptime(Initial_Time,"%Y-%m-%d %H:%M:%S,%3N") | eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S") | eval difference = abs(itime - stime) | eval time_difference=tostring(difference, "duration")</LI-CODE> Fri, 23 Feb 2024 15:08:44 GMT selvam_sekar 2024-02-23T15:08:44Z https://community.splunk.com/t5/Splunk-Search/time-difference-between-two-fields/m-p/678484#M232018 <P>Hi,</P> <P>I have two fields, where time zone seems to be different.. please could you help me to get difference ?&nbsp;</P> <P>itime=&nbsp;<SPAN>2024-02-22 20:56:02,185</SPAN></P> <P>stime=<SPAN>2024-02-23T01:56:02Z</SPAN></P> <P>I tried the below but it always gives around 5 hrs delay..</P> <P>SPL:</P> <LI-CODE lang="markup">| eval itime=strptime(Initial_Time,"%Y-%m-%d %H:%M:%S,%3N") | eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S") | eval difference = abs(itime - stime) | eval time_difference=tostring(difference, "duration")</LI-CODE> Fri, 23 Feb 2024 15:08:44 GMT https://community.splunk.com/t5/Splunk-Search/time-difference-between-two-fields/m-p/678484#M232018 selvam_sekar 2024-02-23T15:08:44Z https://community.splunk.com/t5/Splunk-Search/time-difference-between-two-fields/m-p/678487#M232019 <P>Have you tried incorporating the time zone in the <FONT face="courier new,courier">strptime</FONT> call?</P><LI-CODE lang="markup">| eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S%Z")</LI-CODE><P>&nbsp;</P> Fri, 23 Feb 2024 13:57:06 GMT https://community.splunk.com/t5/Splunk-Search/time-difference-between-two-fields/m-p/678487#M232019 richgalloway 2024-02-23T13:57:06Z