I am using the splunk field: _time and subtracting my own time field: open_date from the time field. The goal is to get the difference between these two time stamps. For example, one entry in the _time field is: "2021-03-11 11:17:13" and one entry in the open_date field is: "2021-06-07T14:50:42".
I am running the current query operations:
| eval difference = abs(_time - strptime(open_date, "%Y-%m-%dT%H:%M:%S")) | eval difference = strftime(difference,"%Y-%m-%dT%H:%M:%S")
When running this for the above example entries I get a difference output of "1970-03-29T20:10:19", which is obviously incorrect. What am I doing wrong and how can I get the correct difference between these two fields?
I would try this:
| eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S")
| eval open_date = (strptime(open_date, "%Y-%m-%dT%H:%M:%S")
| eval diff = abs(mytime - open_date)
| eval difference = strftime(diff,"%Y-%m-%dT%H:%M:%S")
When you call the _time variable by default it is in UTC so you need to format both fields before running the final equation. Please upvote if this helps! 🙂
That didn't return any results for me 😞
Try this! Using now() instead of _time works a lot better from my experience. I was able to test this too so let me know if this works for you then!
| makeresults
| eval open_date = "2021-06-07T14:50:42"
| eval open=strptime(open_date, "%F")
| eval days=round((now()-open),0)
| table open open_date _time days
Here's another Splunk Answer I found that may be helpful too! https://community.splunk.com/t5/Splunk-Search/Compare-a-date-field-with-current-date/m-p/65056