https://community.splunk.com/t5/Splunk-Search/How-to-subtract-two-specific-requestTime/m-p/10303#M439 <P>For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T08:43:15" when pageSubmitted="/snapcCustomer.xhtml" from requestTime="2009-05-26T08:47:23" when pageSubmitted="/snapcPremium.xhtml" 08:47:23 - 08:43:15 = 4:12 (4 minutes and 12 seconds) This the value I want to compute. How can I achieve this?</P> Sat, 20 Mar 2010 00:26:38 GMT Alan_Bradley 2010-03-20T00:26:38Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-two-specific-requestTime/m-p/10303#M439 <P>For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T08:43:15" when pageSubmitted="/snapcCustomer.xhtml" from requestTime="2009-05-26T08:47:23" when pageSubmitted="/snapcPremium.xhtml" 08:47:23 - 08:43:15 = 4:12 (4 minutes and 12 seconds) This the value I want to compute. How can I achieve this?</P> Sat, 20 Mar 2010 00:26:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-two-specific-requestTime/m-p/10303#M439 Alan_Bradley 2010-03-20T00:26:38Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-two-specific-requestTime/m-p/10304#M440 <P>convert dur2sec works well for this one:</P> <PRE><CODE>&lt;search_terms&gt; | convert dur2sec(requestTime) as reqTimeConverted | convert dur2sec(responseTime) as respTimeConverted | eval duration=respTimeConverted-reqTimeConverted </CODE></PRE> Sat, 20 Mar 2010 00:27:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-two-specific-requestTime/m-p/10304#M440 matt 2010-03-20T00:27:30Z