Splunk Search

calculate difference between 2 dates and times with strftime

Communicator

I have the below search:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start
``````

the evals for start and stop are working fine but the eval for difftime is not working. As I'm using strftime how can i calculate the duration between the 2 dates and times?

Tags (2)
1 Solution
SplunkTrust

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using `strptime` first. Try this:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
``````
---
If this reply helps you, Karma would be appreciated.
Builder

You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start
``````

This will give you diffTime in seconds, which you can do with what you want.

SplunkTrust

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using `strptime` first. Try this:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
``````
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!