Splunk Search

## How to subtract two time fields?

Path Finder

How would I go about subtracting EndTime from BeginTime?

Tags (4)
1 Solution
Super Champion

Try this run anywhere search:

``````|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")|eval days=round((EndTime-BeginTime)/86400)
``````
Ultra Champion

hello there,
try this:

``````... your search ...
|eval end_time_epoch = strptime(EndTime, "%m/%d/%Y %H:%M:%S")
|eval begin_time_epoch = strptime(BeginTime, "%m/%d/%Y %H:%M:%S")
| eval duration = end_time_epoch - begin_time_epoch
``````

hope it helps

Path Finder

How would I make the epoch time human readable? Results to display in a manner such as, 8d 15 hrs 20 minutes?

Ultra Champion

try this at the end of your query:

``````  | eval "duration_Days+HHMMSS" = tostring(duration, "duration")
``````
Super Champion

Try this run anywhere search:

``````|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")|eval days=round((EndTime-BeginTime)/86400)
``````
Path Finder

how would you go about getting results in minutes?

Super Champion

to get results in min divide the difference(in sec.) by 60

``````...|eval minutes=round((EndTime-BeginTime)/60)
``````
Super Champion

if you want duration in `day` `hr` and `min` then try this run anywhere search:

``````|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")| eval stringSecs = tostring((EndTime-BeginTime), "duration")| eval stringSecss = replace(stringSecs,"(\d+)\+(\d+)\:(\d+)\:.*","\1d \2h \3min ")
``````
Path Finder

thank you!

Super Champion

Get Updates on the Splunk Community!

#### 2024 Splunk Career Impact Survey | Earn a \$20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

#### Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

#### What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...