How do I convert this timestamp string to a number?

[luky]

Hello all!

I have alphanumeric timestamps that I'd like to convert to seconds. I'm trying to convert these two timestamps to seconds and then subtract one from the other to find the total duration of a phone call. 

Wed Mar 03 13:38:36 PST 2021

Wed Mar 03 13:29:29 PST 2021

Could someone please point me in the right direction? Much appreciated, this has got me at my wit's end!

[acfecondo75]

Hi luky!

You would accomplish this using an eval and the strptime function. The SPL below should work as long as you substitute the string_time variable that I used with whatever variable holds the time value in your data.

Once they're both converted, you can do another eval that subtracts one from the other.

| makeresults
| eval call_start="Wed Mar 03 13:29:29 PST 2021", call_end="Wed Mar 03 13:38:36 PST 2021"
| eval call_start_epoch=strptime(call_start,"%a %b %d %H:%M:%S %Z %Y"),call_end_epoch=strptime(call_end,"%a %b %d %H:%M:%S %Z %Y")
| eval call_duration=call_end_epoch - call_start_epoch

[richgalloway]

That's what the strptime() function is for.

| eval number = strptime(string, "%a %b %d %H:%M:%S %Z %Y")

[Jabernathy]

That doesn't always work. I cant seem to find a good solution for this type of problem either.
I can't convert this timestamp for subtraction purposes for example (see how t3 column is empty?):

[ITWhisperer]

Line 3 creates a string in t2 so line 4 should be parsing the string strptime not strftime