https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181283#M52268 <P>Thanks, that got me there.</P> <P><CODE><BR /> |dbinspect index=main<BR /> | eval span=tostring((endEpoch-startEpoch), "duration") | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S")<BR /> | table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount,splunk_server,path<BR /> </CODE></P> Tue, 29 Sep 2020 07:02:33 GMT ltrand 2020-09-29T07:02:33Z https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181281#M52266 <P>So I'm trying to display what the timespan is from start to finish of a bucket and add it as a new field to the table.</P> <PRE><CODE>|dbinspect index=main | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S") | eval span=tostring((end_time-start_time), "duration") | table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount </CODE></PRE> <P>The problem is that the eval statement that is supposed to calculate span is not functioning correctly, it is just empty for each line. Any thoughts on how I can fix this?</P> Wed, 19 Aug 2015 17:49:33 GMT https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181281#M52266 ltrand 2015-08-19T17:49:33Z https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181282#M52267 <P>Subtract times using epochs rather than strings. Then convert it into a human-readable format, if desired.</P> <PRE><CODE>... | eval span=endEpoch-startEpoch | ... </CODE></PRE> Wed, 19 Aug 2015 17:55:48 GMT https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181282#M52267 richgalloway 2015-08-19T17:55:48Z https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181283#M52268 <P>Thanks, that got me there.</P> <P><CODE><BR /> |dbinspect index=main<BR /> | eval span=tostring((endEpoch-startEpoch), "duration") | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S")<BR /> | table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount,splunk_server,path<BR /> </CODE></P> Tue, 29 Sep 2020 07:02:33 GMT https://community.splunk.com/t5/Splunk-Search/Eval-difference-between-two-fields-for-each-entry/m-p/181283#M52268 ltrand 2020-09-29T07:02:33Z