Splunk Search

Unable to find the difference in time between two events. What am I doing wrong?

_dave_b
Communicator

Hello, I am trying to report on the differences in time between two events. To do so seems straightforward enough. Take

 eventA = _time (of event A)
 eventB = _time (of event B)
 TimeDifference = strftime((EpochTime(event A) - EpochTime(event B)) , "%H:%M:%S")

The time between events occurs pretty reliably every 30 minutes or so, as reflected in the logs. Yet, in my reports, I'm getting values like 30 hours. My first assumption would be that I mixed the Hours and Minutes up, but I haven't. Is there something wrong with my approach for finding the time difference? I am baffled.

Thanks for your time.

0 Karma
1 Solution

sundareshr
Legend

Time difference is calculated as duration which is typically in seconds. So try this

TimeDifference = tostring((EpochTime(event A) - EpochTime(event B)) , "duration")

View solution in original post

sundareshr
Legend

Time difference is calculated as duration which is typically in seconds. So try this

TimeDifference = tostring((EpochTime(event A) - EpochTime(event B)) , "duration")

_dave_b
Communicator

That works, i'm getting my expected value. Thanks!

I still don't see why strftime doesn't apply towards this, though.

0 Karma

_dave_b
Communicator

Thanks for your reply. Why wouldn't strftime work? Seems like that should be the way to go according to the documentation.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...