Splunk Search

How to calculate time difference?

EvansB
Path Finder

I'm looking to get a difference between both times and create a 3rd field for the results (Properties.actionedDate - _time). My current query is like this

 

index=* source=* | table Properties.actionedDate, _time

 


Here is a screenshot of my current result

EvansB_0-1662563212282.png

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I probably should make this a macro since I give this answer a lot.  Timestamps must be in epoch (integer) format to be compared or to find their difference.  Use the strptime function for that.

 

 

index=* source=* 
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff

 

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I probably should make this a macro since I give this answer a lot.  Timestamps must be in epoch (integer) format to be compared or to find their difference.  Use the strptime function for that.

 

 

index=* source=* 
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff

 

 

 

---
If this reply helps you, Karma would be appreciated.

EvansB
Path Finder

Thanks for your response.
This should work but I'm not getting results on the diff field - (I sorted with this field)
Does that mean there are no difference between timestamps and _time?

EvansB_0-1662565524803.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I noticed a typo in the strptime format string in my reply, which I've corrected.  I also added a rename command in case eval doesn't like the original field name.

---
If this reply helps you, Karma would be appreciated.
0 Karma

EvansB
Path Finder

did you edit your first comment.... I'm getting same results 
can you post the corrected query? 
Appreciate.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't know what happened to my original edit, but I've re-posted it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

EvansB
Path Finder

I eventually used this

index=* source=*
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(actionedDate, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS 
| table actionedDate, _time, diff

Appreciate you @richgalloway