Getting Data In

How do you build a chart from two date fields?

gcescatto
New Member

On my current data I have two date fields: CommencementDate and CompletitionDate.
I would like to build a chart where the timestamp would be CompletitionDate - CommencementDate. For that, I created the query below:

| eval InspectionDate=strptime(CompletionDate, “%Y-%m-%dT%H:%M:%S”)-strptime(CommencementDate, “%Y-%m-%dT%H:%M:%S”) |

The date format is: 2015-01-27T06:00:00

Could someone please advise?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You almost had it. Once you subtract the respective epoch times you just need to put the result back into text form.

... | eval InspectionDate=strftime(strptime(CompletionDate, “%Y-%m-%dT%H:%M:%S”)-strptime(CommencementDate, “%Y-%m-%dT%H:%M:%S”), "%Y-%m-%dT%H:%M:%S") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You almost had it. Once you subtract the respective epoch times you just need to put the result back into text form.

... | eval InspectionDate=strftime(strptime(CompletionDate, “%Y-%m-%dT%H:%M:%S”)-strptime(CommencementDate, “%Y-%m-%dT%H:%M:%S”), "%Y-%m-%dT%H:%M:%S") | ...
---
If this reply helps you, Karma would be appreciated.

gcescatto
New Member

Hi richgalloway (:

I did try using the updated query you provided me, but I’m still not getting any results for InspectionTime... any other inputs? 🙂

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...