https://community.splunk.com/t5/Splunk-Search/Compare-timestamps/m-p/37462#M8372 <P>Is it possible to compare two times and get the difference in seconds? I have a field I am extracting called rec_time that I would like to compare to the timestamp on the event. This will show us the delay of processing the message. Both timestamps are in 24H time ..:..:..</P> <P>Thanks!</P> Thu, 26 Aug 2010 09:49:58 GMT ericrobinson 2010-08-26T09:49:58Z https://community.splunk.com/t5/Splunk-Search/Compare-timestamps/m-p/37462#M8372 <P>Is it possible to compare two times and get the difference in seconds? I have a field I am extracting called rec_time that I would like to compare to the timestamp on the event. This will show us the delay of processing the message. Both timestamps are in 24H time ..:..:..</P> <P>Thanks!</P> Thu, 26 Aug 2010 09:49:58 GMT https://community.splunk.com/t5/Splunk-Search/Compare-timestamps/m-p/37462#M8372 ericrobinson 2010-08-26T09:49:58Z https://community.splunk.com/t5/Splunk-Search/Compare-timestamps/m-p/37463#M8373 <P>The timestamp of the event is already available in epoch seconds in the field called <CODE>_time</CODE>. The next step is to convert <CODE>rec_time</CODE> to an epoch seconds using the eval command and strptime. Let's assume that it's formatted as: <CODE>2010-08-25T19:55:01-0700</CODE>. Your search would be:</P> <PRE><CODE>... | eval diff = _time - strptime(rec_time, "%Y-%m-%dT%H:%M:%S%z") </CODE></PRE> Thu, 26 Aug 2010 09:57:59 GMT https://community.splunk.com/t5/Splunk-Search/Compare-timestamps/m-p/37463#M8373 Stephen_Sorkin 2010-08-26T09:57:59Z