Splunk time difference showing as null

[Das]

I need to calculate time difference between start and end times. But I get the difference value as null. Not sure what I am missing.

Below is the sample query
| makeresults
| eval a="27 Mar 2025,02:14:11"
| eval b="27 Mar 2025,03:14:12"
| eval stime=strptime(a,"%d %b %Y,%H:%M:%S")
| eval etime=strptime(b,"%d %b %Y,%H:%M:%S")
| eval diff = eTime - sTime
| table a b stime etime diff

I get the below result with diff value empty:

a b stime etime diff

27 Mar 2025,02:14:11

27 Mar 2025,03:14:12

1743041651.000000

1743045252.000000

Please help in identifying where I am going wrong

[yuanliu · Accepted solution]

---

Please help in identifying where I am going wrong

---

How about spelling error?

| makeresults
| eval a="27 Mar 2025,02:14:11"
| eval b="27 Mar 2025,03:14:12"
| eval stime=strptime(a,"%d %b %Y,%H:%M:%S")
| eval etime=strptime(b,"%d %b %Y,%H:%M:%S")
| eval diff = etime - stime
| table a b stime etime diff

a	b	stime	etime	diff
27 Mar 2025,02:14:11	27 Mar 2025,03:14:12	1743066851.000000	1743070452.000000	3601.000000

[Das]

Thanks for noticing it. 
Its my bad. its working as expected.