Why does time difference between two time stamps in a single event come out null?

[kapoorsumit2020]

Team,

Time difference between end_task_date and start_task_date is coming null. Could you please take a look below and let me know what's wrong in my query.

SPL:

index=cloud sourcetype=lambda:Airflow2Splunk "\"logGroup\"" "\"airflow-OnePIAirflowEnvironment-DEV-Task\""
| rex field=_raw "Marking task as (?<status>[^\.]+)"
| where status IN("FAILED", "SUCCESS", "UP_FOR_RETRY")
| rex field=_raw "dag_id=(?<dag_id>\w+)"
| rex field=_raw "task_id=(?<task_id>\w+)"
| rex field=_raw "start_date=(?<task_start_date>\d{8}T\d{6})"
| rex field=_raw "end_date=(?<task_end_date>\d{8}T\d{6})"
| eval start_task_date=strptime(task_start_date,"%Y%m%dT%H%M%S")
| eval start_task_date=strftime(start_task_date,"%Y-%m-%d %H:%M:%S")
| eval end_task_date=strptime(task_end_date,"%Y%m%dT%H%M%S")
| eval end_task_date=strftime(end_task_date,"%Y-%m-%d %H:%M:%S")
| eval diff=end_task_date-start_task_date
| eval diff=strftime(diff, "%H:%M:%S")
| sort - _time
| table dag_id task_id status start_task_date end_task_date diff

the value for diff column is coming null. for other columns i'm getting the data correctly.

Here are sample values for date fields:

end_task_date:

2022-04-06 20:51:11 
2022-04-06 20:54:09

end_task_date:

2022-04-06 20:51:09
2022-04-06 20:52:07

end_date:

20220406T205111
20220406T205409

start_date:

20220406T205109
20220406T205207

Please let me know if you need additional information pertaining to this request.

Thanks,

Sumit

[PickleRick]

I don't get it. Either I see something wrong or you're strptime'ing some string to get a timestamp only to strftime it back to a string? What's the point? Then you're trying to substract one string from another. It doesn't work that way.

You should do strptime on those fields to get timestamps, then do the substraction and finally maybe render the difference to a string, but not by strftime, but rather by tostring() with format "duration"