how to subtract two date and time

[Mohsin123]

Hi ,

I have two date formats

i have to subtract to find the time duratiuon.Can anyone help me convert these to epoch time and then subtract

2018-03-29 10:54:55.0

Regards
Shraddha

[somesoni2]

Try like this

your current search with datefield1 and datefield2 which you want to subtract for duration
| eval duration_secs=strptime(datefield2,"%Y-%m-%d %H:%M:%S.%N")-strptime(datefield1,"%Y-%m-%d %H:%M:%S.%N")
| eval duration_str=tostring(duration,"duration")

[sudosplunk]

Hello there,

Assuming you have your timestamps as start_date=2018-03-29 10:54:55.0 end_date=2018-04-29 10:54:55.0

Give this a shot,

your_base search 
     | eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N") 
     | eval end=strptime(end_date, "%Y-%m-%d %H:%M:%S.%N") 
     | eval difference = end - start 
     | table difference

Additionally, have a look at the below links for more details.

https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/DateandTimeFunctions