Archive

calculate hours difference between times

New Member

I want to calculate the hours difference between two times, I am using the below search command but its not working, please help to correct my search command

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval diff = endTime - startTime
Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Timestamps can only be compared in epoch form. Try this.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, an upvote would be appreciated.

Influencer

Doesn't convert mktime create epoch fields?

0 Karma

SplunkTrust
SplunkTrust

Yes, that third pipe turns any field that ends with "Time" (*Time) into an epoch time field.

0 Karma

SplunkTrust
SplunkTrust

You're right. Correcting the time format in the convert command should be enough. If it still doesn't work then this alternative should.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Influencer

Your timeformat parameter does not match your time format. Try timeformat="%Y-%m-%dT%H:%M:%SZ"

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!