Calculate Date Diff - two different events in the two different sourcetypes

[erick_costa]

sourcetype=teste1
============================
code, datahora
_________________
1, 2013-05-07 15:51:13.772

sourcetype=teste2
============================
code, datahora
_________________
1, 2013-05-07 15:55:13.060

[aholzer]

Perform an eval "strptime" on both dates, or a convert with timeformat, then simply use another eval to do the subtraction.

Something like this from this answer (http://splunk-base.splunk.com/answers/10021/delta-between-two-date-data-fields):
...| convert timeformat='%m-%d-%Y %T' mktime(starttime) mktime(endtime) | eval duration=(endtime-starttime)/86400

There are quite a few different ways to do it. If you search for "splunk difference between two dates", or "splunk subtracting two dates" or similar, you should get quite a few answers to your question.

[erick_costa]

How to calculate datediff?

[Ayn]

Yes? Did you have a question?