Time difference in splunk

[vijaya5]

I have time stamp like below format
2020-02-17 18:23:04

and i woul like to calculate the differene between two such fields start an end times of an activity. which function i can use to get time difference if the time format is like above?.

[gcusello · Accepted solution]

Hi @vijaya5,
to calculate a difference of two dates/times, you have to transform them in epochtime (using strptime function) then you can caculate the difference:

| eval diff=strptime(time2,"%Y-%m-%d %H:%M:%S")-strptime(time1,"%Y-%m-%d %H:%M:%S")

Ciao.
Giuseppe