topic Re: Find time differences between two extracted fields in the format HH:MM:SS in Splunk Search https://community.splunk.com/t5/Splunk-Search/Find-time-differences-between-two-extracted-fields-in-the-format/m-p/172834#M49567 <P>To get the duration in the new field <CODE>dur</CODE>;</P> <PRE><CODE>...| eval st=strptime(start_time, "%H:%M:%S") | eval et=strptime(end_time,"%H:%M:%S") | eval diff = et - st | eval dur = tostring(diff, "duration") </CODE></PRE> <P>Read more on <CODE>eval</CODE> functions here;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> <P>/k</P> Mon, 09 Dec 2013 23:46:13 GMT kristian_kolb 2013-12-09T23:46:13Z Find time differences between two extracted fields in the format HH:MM:SS https://community.splunk.com/t5/Splunk-Search/Find-time-differences-between-two-extracted-fields-in-the-format/m-p/172833#M49566 <P>I have two fields in a single search row. start_time and end_time. they are both in the format HH:MM:SS. I'd like to calculate the duration end_time - start_time and have the results in the same format HH:MM:SS.</P> <P>thanks!</P> Mon, 28 Sep 2020 15:27:05 GMT https://community.splunk.com/t5/Splunk-Search/Find-time-differences-between-two-extracted-fields-in-the-format/m-p/172833#M49566 krussell101 2020-09-28T15:27:05Z Re: Find time differences between two extracted fields in the format HH:MM:SS https://community.splunk.com/t5/Splunk-Search/Find-time-differences-between-two-extracted-fields-in-the-format/m-p/172834#M49567 <P>To get the duration in the new field <CODE>dur</CODE>;</P> <PRE><CODE>...| eval st=strptime(start_time, "%H:%M:%S") | eval et=strptime(end_time,"%H:%M:%S") | eval diff = et - st | eval dur = tostring(diff, "duration") </CODE></PRE> <P>Read more on <CODE>eval</CODE> functions here;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> <P>/k</P> Mon, 09 Dec 2013 23:46:13 GMT https://community.splunk.com/t5/Splunk-Search/Find-time-differences-between-two-extracted-fields-in-the-format/m-p/172834#M49567 kristian_kolb 2013-12-09T23:46:13Z