Archive

calculate hours difference between times

New Member

I want to calculate the hours difference between two times, I am using the below search command but its not working, please help to correct my search command

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval diff = endTime - startTime
Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Timestamps can only be compared in epoch form. Try this.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, an upvote would be appreciated.

Influencer

Doesn't convert mktime create epoch fields?

0 Karma

SplunkTrust
SplunkTrust

Yes, that third pipe turns any field that ends with "Time" (*Time) into an epoch time field.

0 Karma

SplunkTrust
SplunkTrust

You're right. Correcting the time format in the convert command should be enough. If it still doesn't work then this alternative should.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Influencer

Your timeformat parameter does not match your time format. Try timeformat="%Y-%m-%dT%H:%M:%SZ"