Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do I calculate elapsed time difference between...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a timestamp in EST and one from any other non-EST timezone how do I calculate the elapsed time between them both?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey
Test this solution. You just need to figure out which are the TZ syntax Splunk allows:
| makeresults
| eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
| eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z")
| eval t3=t2-t1
Then do the difference of the two fields and voilá
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey
Test this solution. You just need to figure out which are the TZ syntax Splunk allows:
| makeresults
| eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
| eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z")
| eval t3=t2-t1
Then do the difference of the two fields and voilá
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Absolutely!! Thanks again. I'm new to this and I am upvoting it now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This looks like it should work & thank you for your answers. I was not sure how to pass the timezone, however your answer is very illustrative and I appreciate it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No problem. If the answer is correct please don't forget to upvote it and accept
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone show me an example? Should I append the TimeZone code "EST" or "CST" or "PST" as the suffix on the TIMESTAMP I am using STRPTIME to convert?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use the epoch of both your timestamps. As it is universal, you'll get accurate and correct results.
Basically you just need to make sure they are both timestamps and do one minus the other because splunk automatically interprets then as epoch time
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
