https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256682#M76866 <P>Ok got it thanks!</P> Fri, 04 Dec 2015 14:01:42 GMT vinay4444 2015-12-04T14:01:42Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256678#M76862 <P>Tried using below search, but can't get result. I get null values in diff:</P> <PRE><CODE>XXX| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") | eval diff= tostring(indextime - capturetime) | table indextime capturetime diff </CODE></PRE> <P>Am I missing something?</P> Fri, 04 Dec 2015 11:42:54 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256678#M76862 vinay4444 2015-12-04T11:42:54Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256679#M76863 <P>Just do the diff calculation on the actual epoch value, before your strftime evals. </P> <PRE><CODE>XXX| eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") | | table indextime capturetime diff </CODE></PRE> Fri, 04 Dec 2015 12:19:15 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256679#M76863 jplumsdaine22 2015-12-04T12:19:15Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256680#M76864 <P>i tried that but it does not give the difference in min or secs <BR /> e.g<BR /> capturetime indextime diff<BR /> 2015-12-04 07:33:44 2015-12-04 07:33:50 6</P> Fri, 04 Dec 2015 12:36:01 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256680#M76864 vinay4444 2015-12-04T12:36:01Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256681#M76865 <P>The diff field is in seconds. <BR /> The _indextime and _time fields are in unix epoch time format, the number of seconds since January 1970. When you subtract one from the other the result is a value expressed in seconds</P> Fri, 04 Dec 2015 12:54:18 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256681#M76865 jplumsdaine22 2015-12-04T12:54:18Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256682#M76866 <P>Ok got it thanks!</P> Fri, 04 Dec 2015 14:01:42 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256682#M76866 vinay4444 2015-12-04T14:01:42Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256683#M76867 <P>No problem mate. If that's working for you do you mind accepting the answer?</P> <P>Cheers</P> Fri, 04 Dec 2015 14:14:07 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-difference-between-time-and-indextime-in-secs/m-p/256683#M76867 jplumsdaine22 2015-12-04T14:14:07Z