Splunk IT Service Intelligence

Time difference in splunk

vijaya5
Engager

I have time stamp like below format
2020-02-17 18:23:04

and i woul like to calculate the differene between two such fields start an end times of an activity. which function i can use to get time difference if the time format is like above?.

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @vijaya5,
to calculate a difference of two dates/times, you have to transform them in epochtime (using strptime function) then you can caculate the difference:

| eval diff=strptime(time2,"%Y-%m-%d %H:%M:%S")-strptime(time1,"%Y-%m-%d %H:%M:%S")

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @vijaya5,
to calculate a difference of two dates/times, you have to transform them in epochtime (using strptime function) then you can caculate the difference:

| eval diff=strptime(time2,"%Y-%m-%d %H:%M:%S")-strptime(time1,"%Y-%m-%d %H:%M:%S")

Ciao.
Giuseppe

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!