Splunk Search

How can i calculate datetime Difference between two datetime values.

abhishekgupta61
Engager

Begin date - 2018-05-02 22:00:23.235371
End Date - 2018-05-02 22:01:33.815546

Expected Result should be - 70

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Hey, try this:

| makeresults
| eval begin="2018-05-02 22:00:23.235371"
| eval end="2018-05-02 22:01:33.815546"
| eval begin_epoch=strptime(begin, "%Y-%m-%d %H:%M:%S")
| eval end_epoch=strptime(end, "%Y-%m-%d %H:%M:%S")
| eval diff=end_epoch-begin_epoch

The field diff will then contain the difference between the two. I left out the milliseconds on purpose, because you said you expected "70" as a result.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...