Alerting

How to get the time diffrence

9198459056
Loves-to-Learn Everything

I have 2 time A anb B is in HH:MM:SS format ..then how to get the difference of A and B in same format

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @9198459056,

You need to convert time to epoch format for calculation. You can use the below options;

Difference is duration format;
eval diff=tostring(round(strptime(A,"%H:%M:%S")-strptime(B,"%H:%M:%S")),"duration")

Difference in seconds;
eval diff=round(strptime(A,"%H:%M:%S")-strptime(B,"%H:%M:%S"))

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

9198459056
Loves-to-Learn Everything

i asked so many questions but till now did not the single answer of any of my question🙄

0 Karma

9198459056
Loves-to-Learn Everything

I used diff=(B-A) and then diff=A-B nothing worked

 

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...