calculate difference between 2 dates and times with strftime

[Sfry1981]

I have the below search:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

the evals for start and stop are working fine but the eval for difftime is not working. As I'm using strftime how can i calculate the duration between the 2 dates and times?

[jpolvino]

You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

This will give you diffTime in seconds, which you can do with what you want.

[richgalloway · Accepted solution]

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using strptime first. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")