How can I subtract 2 times together/why won't the search string I'm trying work?

[sdorich]

So I have seen an answer related to this question on Splunk Answers but the answer that was given is not working for me. I have tried the following as my search string and it seems like mktime() is having trouble converting the human readable time I've provided to epoch time.

eventtype=bsm_events | convert mktime(event.time_received_label) as t2 mktime(event.time_created_label) as t1 | eval elapsed = t2-t1 | table t1,t2,elapsed

I've tried mktime() with 2 separate time formats.

1. 2014-02-18T21:09:24.804-07:00
2. 02/18/2014 9:09:24 PM

I've also tried using strptime() but had issues with that too.

Thanks in advanced.

[somesoni2]

here you go.

[sdorich]

Thanks - I knew I must have been missing something. That works! You should make your comment as an answer so I can mark this question as answered.

[somesoni2 · Accepted solution]

The correct syntax is '| convert timeformat="specify time format present in your field" mktime(yourfield) as fieldalias"'.