How to get the time elapsed between these two fields?

[Clecimar]

Guys, can you help me ?

I need to know the elapsed time between this two fields:

CREATED_TS: 20220816182818.215
CURRENT_TIMESTAMP: 20220816185516

Do you have a tip on how can do this ?

Thank you.

Clecimar

[richgalloway · Accepted solution]

To compare two times in Splunk you must first convert them into epoch (integer) form.  Do that using the strptime function.

| eval created = strptime(CREATED_TS, "%Y%M%D%H%M%S.%3N")
| eval current = strptime(CURRENT_TIMESTAMP, "%Y%M%D%H%M%S")
| eval diff = current - created