https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200211#M58028 <P>I have two events</P> <P>I'm using this</P> <PRE><CODE>nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time| </CODE></PRE> <P>start date or vendor notified time looks like this : <CODE>2016-10-21 18:59:00</CODE><BR /> I want to see results difference in minutes??</P> Mon, 31 Oct 2016 14:18:28 GMT msachdeva3 2016-10-31T14:18:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200211#M58028 <P>I have two events</P> <P>I'm using this</P> <PRE><CODE>nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time| </CODE></PRE> <P>start date or vendor notified time looks like this : <CODE>2016-10-21 18:59:00</CODE><BR /> I want to see results difference in minutes??</P> Mon, 31 Oct 2016 14:18:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200211#M58028 msachdeva3 2016-10-31T14:18:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200212#M58029 <P>turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.</P> <PRE><CODE>|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time </CODE></PRE> Mon, 31 Oct 2016 14:24:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200212#M58029 cmerriman 2016-10-31T14:24:16Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200213#M58030 <P>Assuming you're not getting your latency field populated here, are both VENDOR_NOTIFIED_TIME and START_DATE field appear in separate events? If yes, then you would need to join those two events using some common field.</P> Tue, 29 Sep 2020 11:34:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200213#M58030 somesoni2 2020-09-29T11:34:47Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200214#M58031 <P>convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y/%m/%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y/%m/%d %H:%M:%S"|</P> <P>tried displaying results with table command<BR /> |table nt_time st_time |head 5</P> <P>these fields are empty i.e not working<BR /> unable to convert time i guess</P> Tue, 29 Sep 2020 11:37:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200214#M58031 msachdeva3 2020-09-29T11:37:39Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200215#M58032 <P>what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?</P> <P>I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.</P> Mon, 31 Oct 2016 14:50:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-time-difference-in-minutes-between-two/m-p/200215#M58032 cmerriman 2016-10-31T14:50:22Z