Splunk Search

what is use of diff command

maheshsat
Explorer

Hi , I tried understanding diff command from spunk.doc unable to understand,could you please let me know use of diff command what exactly it does , it would be great if given in answer with example.Thanks

Tags (1)

p_gurav
Champion

Hi,

Diff command will give you difference between two search results. Refer below link for example:
https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff...

logloganathan
Motivator

diff can be used to get the difference between the epoch time.
Please see the below example where i used this query for setting my alert

your base query | eval MyDate=strptime(date,"%d %b %Y %H:%M:%S") | fieldformat StartTime=strptime(MyDate, "%Y-%m-%d %H:%M:%S") | eval Diff=tostring((StartTime-EndTime),"duration")

Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...