topic eval Time difference in Splunk Search

eval Time difference

lpolo — Mon, 28 Sep 2020 10:07:05 GMT

I have the following data indexed:

initialTime     Purchase_Time
2011-11-04T13:17Z   2011-11-04 09:18:20
2011-11-04T21:08Z   2011-11-04 14:08:28
2011-11-04T15:16Z   2011-11-04 16:38:16
2011-11-04T15:15Z   2011-11-04 10:18:12
2011-11-04T21:25Z   2011-11-04 14:26:40
2011-11-04T13:35Z   2011-11-04 09:36:45
2011-11-04T20:01Z   2011-11-04 16:03:02
2011-11-04T19:31Z   2011-11-04 20:28:55

I tried to get the following result set with a splunk query:

|eval Time_Diff = initialTime - Purchase_Time

But I have not been able to...

Thanks.

Re: eval Time difference

eelisio2 — Wed, 16 Nov 2011 21:39:25 GMT

This should give you the difference in seconds.

| eval itime=strptime(initialTime,"%Y-%m-%dT%H:%M") | eval ptime=strptime(PurchaseTime,"%Y-%m-%d %H:%M:%S") | eval TimeDiff=itime-ptime  | table initialTime PurchaseTime TimeDiff

Re: eval Time difference

dwaddle — Thu, 17 Nov 2011 04:31:53 GMT

Ipolo, the reason this works where your initial approach didn't is because the example field values from your search are just strings. Splunk doesn't know how to subtract them and make sense of them. What eelisio is doing is converting the timestamp strings to time_t values (that is, the number of seconds since 1/1/1970 00:00:00 UTC). The time_t format (sometimes called epoch time) is really awesome because you can store large time ranges in simple 32-bit values, and because you can easily figure out the delta between any two timestamps via addition/subtraction.

Re: eval Time difference

dwaddle — Thu, 17 Nov 2011 04:33:00 GMT

Splunk (by default) parses out the first timestamp it sees from an event (well, it could be a different timestamp if you configure it this way) and stores it in time_t format as the field _time. But, it does not do this by default with any additional timestamp-looking data within the event.