How do I convert these timestamps to epoch?

[kmccowen]

Need help converting these times to epoch so that I can do a DIFF between them.

branchExecutionStartTime=Wed Jul 06 09:21:22 CDT 2016
branchExecutionEndTime=Wed Jul 06 09:21:22 CDT 2016

Can anyone help?

[somesoni2]

Have you looked at convert OR eva-strptime commands? Are the timestamp field already extracted?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/convert
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions#Date_and_Time...

[kbarker302 · Accepted solution]

See the answer posted here:

https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html

I tweaked the code sample from the above post to match the date format example you provided:

your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval diff = tostring((ot - it), "duration") 
| table in_time, out_time, diff 

For reference, below are the various date/time format variables Splunk uses:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables