Hi, i am relatively newer to splunk, looking for a solution to get time difference is a splunk sample log like this "attribute1::d1 a2::d2, expectedUpdateDate::2020-09-30 23:30:00, ActualUpdateDate::10/1/20 5:44 PM, CreatedDate::9/30/20 10:14 AM" i need to print both ActualUpdateDate -CreatedDate and expectedUpdateDate - CreatedDate in seconds.
Experts , Could you pls help me here?
Hi @venky10,
you have to extract fields using regex and convert dates in epochtime, then you can calculate the difference.
See this example:
| makeresults
| eval _raw="attribute1::d1 a2::d2, expectedUpdateDate::2020-09-30 23:30:00, ActualUpdateDate::10/1/20 5:44 PM, CreatedDate::9/30/20 10:14 AM"
| rex "expectedUpdateDate::(?<expectedUpdateDate>[^,]+),\s+ActualUpdateDate::(?<ActualUpdateDate>[^,]+),\s+CreatedDate::(?<CreatedDate>.*)"
| eval epoch_expectedUpdateDate=strptime(expectedUpdateDate,"%Y-%m-%d %H:%M:%S"),epoch_ActualUpdateDate=strptime(ActualUpdateDate,"%m/%d/%y %H:%M"),epoch_CreatedDate=strptime(CreatedDate,"%m/%d/%y %H:%M")
| eval diff1=epoch_ActualUpdateDate-epoch_CreatedDate, diff2=epoch_expectedUpdateDate-epoch_CreatedDate
| table epoch_expectedUpdateDate expectedUpdateDate epoch_ActualUpdateDate ActualUpdateDate epoch_CreatedDate CreatedDate diff1 diff2
Ciao.
Giuseppe