Splunk Search
Highlighted

## calculate difference between 2 dates and times with strftime

Communicator

I have the below search:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start
``````

the evals for start and stop are working fine but the eval for difftime is not working. As I'm using strftime how can i calculate the duration between the 2 dates and times?

Tags (2)
1 Solution
Highlighted

## Re: calculate difference between 2 dates and times with strftime

SplunkTrust

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using `strptime` first. Try this:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
``````
---
If this reply helps you, an upvote would be appreciated.
Highlighted

## Re: calculate difference between 2 dates and times with strftime

Builder

You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this:

``````index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p")
| eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start
``````

This will give you diffTime in seconds, which you can do with what you want.