Splunk Search

How to convert the 24hrs time to 12hrs time and show the difference in -ve sign indication?


i have the 2 values let's say
expected time= 6:00:00
completion time= 08:32:44
and the expected output should be the difference of the above i.e (expected-completion) in 12 hrs format including negative sign for example : output= -2:32:44 (which is the diff between expected and completion)

Labels (2)
0 Karma


Convert both times to epoch times (if they aren't already) using strptime()

Then subtract one from the other as diff (for example).

Then use tostring to display as hours:minutes:seconds

| eval x=if(diff<0,"-","").tostring(abs(diff),"duration")


Thanks @ITWhisperer  it worked!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...