Getting Data In

how to subtract two date and time

Path Finder

Hi ,

I have two date formats

i have to subtract to find the time duratiuon.Can anyone help me convert these to epoch time and then subtract

2018-03-29 10:54:55.0


Tags (2)
0 Karma

Revered Legend

Try like this

your current search with datefield1 and datefield2 which you want to subtract for duration
| eval duration_secs=strptime(datefield2,"%Y-%m-%d %H:%M:%S.%N")-strptime(datefield1,"%Y-%m-%d %H:%M:%S.%N")
| eval duration_str=tostring(duration,"duration")
0 Karma


Hello there,

Assuming you have your timestamps as start_date=2018-03-29 10:54:55.0 end_date=2018-04-29 10:54:55.0

Give this a shot,

your_base search 
     | eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N") 
     | eval end=strptime(end_date, "%Y-%m-%d %H:%M:%S.%N") 
     | eval difference = end - start 
     | table difference

Additionally, have a look at the below links for more details.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...