https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744522#M241268 <P>Thanks for noticing it.&nbsp;<BR />Its my bad. its working as expected.</P> Sat, 19 Apr 2025 05:24:35 GMT Das 2025-04-19T05:24:35Z https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744520#M241266 <P>I need to calculate time difference between start and end times. But I get the difference value as null. Not sure what I am missing.</P><P>Below is the sample query<BR />| makeresults<BR />| eval a="27 Mar 2025,02:14:11"<BR />| eval b="27 Mar 2025,03:14:12"<BR />| eval stime=strptime(a,"%d %b %Y,%H:%M:%S")<BR />| eval etime=strptime(b,"%d %b %Y,%H:%M:%S")<BR />| eval diff = eTime - sTime<BR />| table a b stime etime diff<BR /><BR />I get the below result with diff value empty:</P><P>a b stime etime diff</P><TABLE><TBODY><TR><TD>27 Mar 2025,02:14:11</TD><TD>27 Mar 2025,03:14:12</TD><TD>1743041651.000000</TD><TD>1743045252.000000</TD><TD>&nbsp;</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Please help in identifying where I am going wrong</P> Sat, 19 Apr 2025 04:51:05 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744520#M241266 Das 2025-04-19T04:51:05Z https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744521#M241267 <BLOCKQUOTE><HR />Please help in identifying where I am going wrong<HR /></BLOCKQUOTE><P>How about spelling error?</P><LI-CODE lang="markup">| makeresults | eval a="27 Mar 2025,02:14:11" | eval b="27 Mar 2025,03:14:12" | eval stime=strptime(a,"%d %b %Y,%H:%M:%S") | eval etime=strptime(b,"%d %b %Y,%H:%M:%S") | eval diff = etime - stime | table a b stime etime diff</LI-CODE><TABLE><TBODY><TR><TD>a</TD><TD>b</TD><TD>stime</TD><TD>etime</TD><TD>diff</TD></TR><TR><TD>27 Mar 2025,02:14:11</TD><TD>27 Mar 2025,03:14:12</TD><TD>1743066851.000000</TD><TD>1743070452.000000</TD><TD>3601.000000</TD></TR></TBODY></TABLE> Sat, 19 Apr 2025 05:19:17 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744521#M241267 yuanliu 2025-04-19T05:19:17Z https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744522#M241268 <P>Thanks for noticing it.&nbsp;<BR />Its my bad. its working as expected.</P> Sat, 19 Apr 2025 05:24:35 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-time-difference-showing-as-null/m-p/744522#M241268 Das 2025-04-19T05:24:35Z