Getting Data In

How to calculate difference between two time stamps

ken_lynch
Engager

Hi, I have seen a few post on this subject, but none seem to fix my issue. I am trying to calculate the difference between two date/time stamps. 

| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End

The issue seems to be that the Start field is empty when i add it to a table, however, the End time works. The only difference between start and end is that end is being set by the eval/if statement for CompleteDate because all are null. Start/AwaitingResponseDate is an auto extracted field 

The date/time format is the same for each filed. This is an example of the AwaitingResponseDate value
2020-07-20 18:35:15.0000000
This is an example of the inserted CompleteDate field from the same record

2020-08-19 09:19:53:0000000

Any help is certainly appreciated.

 

0 Karma
1 Solution

harsmarvania57
Ultra Champion

In your AwaitingResponseDate after second it is . (dot) not : (colon) 2020-07-20 18:35:15.0000000

So your query will be

| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S.%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

In your AwaitingResponseDate after second it is . (dot) not : (colon) 2020-07-20 18:35:15.0000000

So your query will be

| eval CompleteDate=if(isnull(CompleteDate) OR len(CompleteDate)==0,strftime(now(),"%Y-%m-%d %H:%M:%S:%7Q"),CompleteeDate)
|eval Start = strptime(AwaitingResponseDate,"%Y-%m-%d %H:%M:%S.%7Q")
|eval End = strptime(CompleteDate,"%Y-%m-%d %H:%M:%S:%7Q")
|eval WaitTime = Start-End
0 Karma

ken_lynch
Engager

Thank you so much....it is the little things 🙂
Also helps if I use End-Start instead Start-End....

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...