topic Re: Why am I unable to find the time difference between two dates with my current eval statements? in Splunk Search

Why am I unable to find the time difference between two dates with my current eval statements?

changux — Tue, 17 May 2016 22:05:50 GMT

Hi all.

I have one field called date1 with a timestamp like this:

5/7/16 16:35

I need the time difference (just for the date) in days against now(). I am using this expression:

...  | eval onlydate=strftime(strptime(date1,"%-m/%d/%y %H:%M"),"%-m/%-d/%y") | eval nowstring=strftime(now(), "%-m/%-d/%y")

And works well, but I can't calculate the time difference between nowstring and onlydate and both are in the same format. Any clue? I tried using

... | eval difference=(nowstring - onlydate)

And didn't work.

Thanks!

Re: Why am I unable to find the time difference between two dates with my current eval statements?

sundareshr — Tue, 17 May 2016 22:24:48 GMT

strftime is a string format. You need to change to epoch time or a number to do math. So try this

| eval onlydate=strptime(date1,"%-m/%d/%y %H:%M") | eval datediff=tostring(now() - onlydate, "duration")

Re: Why am I unable to find the time difference between two dates with my current eval statements?

changux — Wed, 18 May 2016 01:50:45 GMT

Great, thanks. Datediff result is in epoch, how i can convert to human? i tried with:

. | eval formatted_time=strftime(datediff/1000, "%H:%M:%S %d-%m-%Y")

Without luck.

Re: Why am I unable to find the time difference between two dates with my current eval statements?

changux — Wed, 18 May 2016 01:58:12 GMT

My datediff field has values like 6+08:19:34.000000.

Re: Why am I unable to find the time difference between two dates with my current eval statements?

sheamus69 — Wed, 18 May 2016 09:52:58 GMT

Something like:

...|eval formatted_time=strftime(datediff,"%F %T")

Should do the trick.

Re: Why am I unable to find the time difference between two dates with my current eval statements?

sundareshr — Wed, 18 May 2016 15:55:39 GMT

datediff is in seconds. duration format is days+hours:mins:seconds.microseconds. what format are you looking for?

Re: Why am I unable to find the time difference between two dates with my current eval statements?

sundareshr — Wed, 18 May 2016 16:04:04 GMT

You could do something like this

...| eval onlydate=strptime(date1,"%-m/%d/%y %H:%M") | eval datediff=tostring(round(now() - onlydate, 0), "duration") | eval datediff= replace(datediff,"(\d*)\+?(\d+)\:(\d+)\:(\d+)","\1d \2h \3min \4s")

Re: Why am I unable to find the time difference between two dates with my current eval statements?

changux — Wed, 18 May 2016 20:15:00 GMT

Thanks a lot!