Getting Data In

How do I calculate the difference between these two dates that are not in _time ?

New Member

Hi splunkers!

I have tried to calculate the difference between these two dates (Date Closed) - (Date Created) using eval's , but it's still not working.

I tried to use timestamp as well and I didn't have the results that I want to.

PS** These two fields are not in _time I uploaded the data base as CSV just like in Excel, both are recognized by splunk as strings.

alt text

0 Karma

Super Champion

Please find attached

|makeresults 
| eval Date_Created="25/3/19 14:45" | eval Date_Closed="3/5/19 15:50" 
| eval Date_Created=strptime(Date_Created,"%e/%m/%y %H:%M")
| eval Date_Closed=strptime(Date_Closed,"%e/%m/%y %H:%M")
| eval timeDiff_secs=Date_Closed-Date_Created

Logic is to convert to epoch time and subtract

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!