Splunk Search
Highlighted

How to find the difference between timestamps in a number format that isn't based on dates?

Path Finder

Hi all,

I'm trying to calculate the difference between two dates my search regarding this looks as follows (forgive the messiness, i know it seems a bit redundant)-

| eval it = strptime(Load_Time, "%Y/%m/%d") 
| eval ot = strptime(Time, "%Y/%m/%d %I:%M:%S") 
| eval it2 = strftime(it, "%Y/%m/%d") 
| eval ot2 = strftime(ot, "%Y/%m/%d")
| eval it3 = strptime(it2, "%Y/%m/%d")  
| eval ot3 = strptime(ot2, "%Y/%m/%d")
| eval TimeDiff=   ot3-it3 
| eval TimeDiff2=strftime(TimeDiff, "%j")|
| dedup it2, MTMS
| dedup MTMS, Time 
| sort -Load_Time 
| stats list(LIC) as LIC count list(MTMS) AS MTMS , list(it2) AS LoadTime, list(ot2) As EventDate, list(TimeDiff2) AS Time_Difference ,sum(TimeDiff2) AS Sum,  by Bundle
| eval Machine_Months=Sum/30.4
| sort -Bundle

The problem with this is that the results (difference) I'm given is in Epoch format which I can't use to do the calculations that follow (dividing the sum of all differences by 30.4) and if I use strftime to convert it, then I can only go up to 365 days (using %j ) which isn't a big enough number as some of these differences go beyond that, and for the dates that are the same, lets say 2015/07/09 and 2015/07/09 I get 365 instead of 0

So my overall goal is to get a difference between these dates in a number format that isn't based on dates (so 0 to infinity NOT 0 to 365 or 0 to 31 etc...)
Thank you!

0 Karma
Highlighted

Re: How to find the difference between timestamps in a number format that isn't based on dates?

SplunkTrust
SplunkTrust

To get the time difference in days, divide epoch time by 86400.

| eval TimeDiff2=TimeDiff/86400
---
If this reply helps you, an upvote would be appreciated.

View solution in original post