https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255518#M76511 <P>The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.</P> <PRE><CODE> ... my base search ... | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime </CODE></PRE> Tue, 29 Sep 2020 11:23:30 GMT somesoni2 2020-09-29T11:23:30Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255515#M76508 <P>Hello,</P> <P>I am trying to determine the <STRONG>time difference</STRONG> between the two timeStamp columns in my events.<BR /> I tried to use the search below, but cannot return anything for the "diff" at the end... </P> <PRE><CODE> ... my base search ... | eval raw_time=strptime(_time,'%Y-%m-%dT%H:%M:%S') | eval utc_endtime=strptime(UTC_EndTime,'%Y-%m-%dT%H:%M:%S') | eval diff= raw_time-utc_endtime </CODE></PRE> <P>My example events are like this:</P> <PRE><CODE>2016-10-15T03:59:59.999999, UTC_EndTime=2016-10-14T19:59:59.999999, 2016-10-15T02:59:59.999999, UTC_EndTime=2016-10-14T18:59:59.999999, 2016-10-15T01:59:59.999999, UTC_EndTime=2016-10-14T17:59:59.999999, </CODE></PRE> <P>I would appreciate if you can help me to see the mistake I am doing here.</P> <P>Many thanks!</P> Fri, 14 Oct 2016 23:28:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255515#M76508 pkurt 2016-10-14T23:28:25Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255516#M76509 <P>Change single quotes <CODE>'</CODE> to double quotes <CODE>"</CODE></P> <PRE><CODE>| eval raw_time=strptime(_time,"%Y-%m-%dT%H:%M:%S") | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S") | eval diff= raw_time-utc_endtime </CODE></PRE> Sat, 15 Oct 2016 00:16:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255516#M76509 sundareshr 2016-10-15T00:16:41Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255517#M76510 <P>Use convert. </P> <PRE><CODE> ... my base search ... | Convert mktime(_time) as raw_time timestamp="%Y-%m-%dT%H:%M:%S" | Convert mktime(UTC_EndTime) as utc_endtime "%Y-%m-%dT%H:%M:%S"| eval diff= raw_time-utc_endtime </CODE></PRE> Sat, 15 Oct 2016 01:48:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255517#M76510 cmerriman 2016-10-15T01:48:04Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255518#M76511 <P>The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.</P> <PRE><CODE> ... my base search ... | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime </CODE></PRE> Tue, 29 Sep 2020 11:23:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255518#M76511 somesoni2 2020-09-29T11:23:30Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255519#M76512 <P>it worked, thank you very much!</P> Sun, 16 Oct 2016 14:16:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255519#M76512 pkurt 2016-10-16T14:16:17Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255520#M76513 <P>Thank you very much. Double quotes are not the issue. It works only if I add ".%N" to my time string since the actual timeStamp has ".999999" component. </P> Tue, 18 Oct 2016 17:51:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255520#M76513 pkurt 2016-10-18T17:51:59Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255521#M76514 <P>I could not make this work. Thank you very much though!</P> Tue, 18 Oct 2016 17:58:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-the-difference-between-two/m-p/255521#M76514 pkurt 2016-10-18T17:58:04Z