Subtracting two timestamps returning incorrect difference?

[xoamanda12xo]

I am using the splunk field: _time and subtracting my own time field: open_date from the time field. The goal is to get the difference between these two time stamps. For example, one entry in the _time field is: "2021-03-11 11:17:13" and one entry in the open_date field is: "2021-06-07T14:50:42".

I am running the current query operations:

| eval difference = abs(_time - strptime(open_date, "%Y-%m-%dT%H:%M:%S")) | eval difference = strftime(difference,"%Y-%m-%dT%H:%M:%S")

When running this for the above example entries I get a difference output of "1970-03-29T20:10:19",  which is obviously incorrect. What am I doing wrong and how can I get the correct difference between these two fields?

[astackpole]

I would try this:

| eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S")
| eval open_date = (strptime(open_date, "%Y-%m-%dT%H:%M:%S")
| eval diff = abs(mytime - open_date) 
| eval difference = strftime(diff,"%Y-%m-%dT%H:%M:%S")

 When you call the _time variable by default it is in UTC so you need to format both fields before running the final equation. Please upvote if this helps! 🙂 

[xoamanda12xo]

That didn't return any results for me 😞 

[astackpole]

Try this! Using now() instead of _time works a lot better from my experience. I was able to test this too so let me know if this works for you then!

| makeresults
| eval open_date = "2021-06-07T14:50:42"
| eval open=strptime(open_date, "%F")
| eval days=round((now()-open),0)
| table open open_date _time days

Here's another Splunk Answer I found that may be helpful too! https://community.splunk.com/t5/Splunk-Search/Compare-a-date-field-with-current-date/m-p/65056