Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do I convert these timestamps to epoch?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See the answer posted here:
https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html
I tweaked the code sample from the above post to match the date format example you provided:
your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y")
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y")
| eval diff = tostring((ot - it), "duration")
| table in_time, out_time, diff
For reference, below are the various date/time format variables Splunk uses:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you looked at convert OR eva-strptime commands? Are the timestamp field already extracted?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/convert
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions#Date_and_Time...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See the answer posted here:
https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html
I tweaked the code sample from the above post to match the date format example you provided:
your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y")
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y")
| eval diff = tostring((ot - it), "duration")
| table in_time, out_time, diff
For reference, below are the various date/time format variables Splunk uses:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Unlocking Unified Insights: New Gigamon Federated Search App for Splunk
GA: New Data Management App in Splunk Platform
Announcing Modern Navigation: A New Era of Splunk User Experience
