Hi splunkers!
I have tried to calculate the difference between these two dates (Date Closed) - (Date Created) using eval's , but it's still not working.
I tried to use timestamp as well and I didn't have the results that I want to.
PS** These two fields are not in _time I uploaded the data base as CSV just like in Excel, both are recognized by splunk as strings.
Please find attached
|makeresults
| eval Date_Created="25/3/19 14:45" | eval Date_Closed="3/5/19 15:50"
| eval Date_Created=strptime(Date_Created,"%e/%m/%y %H:%M")
| eval Date_Closed=strptime(Date_Closed,"%e/%m/%y %H:%M")
| eval timeDiff_secs=Date_Closed-Date_Created
Logic is to convert to epoch time and subtract