Splunk Search

How to convert the 24hrs time to 12hrs time and show the difference in -ve sign indication?

srujana96
Explorer

i have the 2 values let's say
expected time= 6:00:00
completion time= 08:32:44
and the expected output should be the difference of the above i.e (expected-completion) in 12 hrs format including negative sign for example : output= -2:32:44 (which is the diff between expected and completion)

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Convert both times to epoch times (if they aren't already) using strptime()

Then subtract one from the other as diff (for example).

Then use tostring to display as hours:minutes:seconds

| eval x=if(diff<0,"-","").tostring(abs(diff),"duration")

srujana96
Explorer

Thanks @ITWhisperer  it worked!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...