Getting Data In

How to calculate difference between two time stamps

ken_lynch
Engager

Hi, I have seen a few post on this subject, but none seem to fix my issue. I am trying to calculate the difference between two date/time stamps. 

| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End

The issue seems to be that the Start field is empty when i add it to a table, however, the End time works. The only difference between start and end is that end is being set by the eval/if statement for CompleteDate because all are null. Start/AwaitingResponseDate is an auto extracted field 

The date/time format is the same for each filed. This is an example of the AwaitingResponseDate value
2020-07-20 18:35:15.0000000
This is an example of the inserted CompleteDate field from the same record

2020-08-19 09:19:53:0000000

Any help is certainly appreciated.

 

0 Karma
1 Solution

harsmarvania57
Ultra Champion

In your AwaitingResponseDate after second it is . (dot) not : (colon) 2020-07-20 18:35:15.0000000

So your query will be

| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S.%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

In your AwaitingResponseDate after second it is . (dot) not : (colon) 2020-07-20 18:35:15.0000000

So your query will be

| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S.%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End
0 Karma

ken_lynch
Engager

Thank you so much....it is the little things 🙂
Also helps if I use End-Start instead Start-End....

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...