Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do I calculate elapsed time difference between...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a timestamp in EST and one from any other non-EST timezone how do I calculate the elapsed time between them both?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey
Test this solution. You just need to figure out which are the TZ syntax Splunk allows:
| makeresults
| eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
| eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z")
| eval t3=t2-t1
Then do the difference of the two fields and voilá
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey
Test this solution. You just need to figure out which are the TZ syntax Splunk allows:
| makeresults
| eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
| eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z")
| eval t3=t2-t1
Then do the difference of the two fields and voilá
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Absolutely!! Thanks again. I'm new to this and I am upvoting it now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This looks like it should work & thank you for your answers. I was not sure how to pass the timezone, however your answer is very illustrative and I appreciate it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No problem. If the answer is correct please don't forget to upvote it and accept
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone show me an example? Should I append the TimeZone code "EST" or "CST" or "PST" as the suffix on the TIMESTAMP I am using STRPTIME to convert?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use the epoch of both your timestamps. As it is universal, you'll get accurate and correct results.
Basically you just need to make sure they are both timestamps and do one minus the other because splunk automatically interprets then as epoch time
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
