Splunk Search

Splunk time difference showing as null

Das
Engager

I need to calculate time difference between start and end times. But I get the difference value as null. Not sure what I am missing.

Below is the sample query
| makeresults
| eval a="27 Mar 2025,02:14:11"
| eval b="27 Mar 2025,03:14:12"
| eval stime=strptime(a,"%d %b %Y,%H:%M:%S")
| eval etime=strptime(b,"%d %b %Y,%H:%M:%S")
| eval diff = eTime - sTime
| table a b stime etime diff

I get the below result with diff value empty:

a b stime etime diff

27 Mar 2025,02:14:1127 Mar 2025,03:14:121743041651.0000001743045252.000000 

 

Please help in identifying where I am going wrong

Labels (1)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Please help in identifying where I am going wrong

How about spelling error?

| makeresults
| eval a="27 Mar 2025,02:14:11"
| eval b="27 Mar 2025,03:14:12"
| eval stime=strptime(a,"%d %b %Y,%H:%M:%S")
| eval etime=strptime(b,"%d %b %Y,%H:%M:%S")
| eval diff = etime - stime
| table a b stime etime diff
abstimeetimediff
27 Mar 2025,02:14:1127 Mar 2025,03:14:121743066851.0000001743070452.0000003601.000000

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Please help in identifying where I am going wrong

How about spelling error?

| makeresults
| eval a="27 Mar 2025,02:14:11"
| eval b="27 Mar 2025,03:14:12"
| eval stime=strptime(a,"%d %b %Y,%H:%M:%S")
| eval etime=strptime(b,"%d %b %Y,%H:%M:%S")
| eval diff = etime - stime
| table a b stime etime diff
abstimeetimediff
27 Mar 2025,02:14:1127 Mar 2025,03:14:121743066851.0000001743070452.0000003601.000000
0 Karma

Das
Engager

Thanks for noticing it. 
Its my bad. its working as expected.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...