Splunk Search

Compare timestamps

ericrobinson
Path Finder

Is it possible to compare two times and get the difference in seconds? I have a field I am extracting called rec_time that I would like to compare to the timestamp on the event. This will show us the delay of processing the message. Both timestamps are in 24H time ..:..:..

Thanks!

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

The timestamp of the event is already available in epoch seconds in the field called _time. The next step is to convert rec_time to an epoch seconds using the eval command and strptime. Let's assume that it's formatted as: 2010-08-25T19:55:01-0700. Your search would be:

... | eval diff = _time - strptime(rec_time, "%Y-%m-%dT%H:%M:%S%z")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...