Splunk Search
Highlighted

calculate difference between 2 dates and times with strftime

Communicator

I have the below search:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

the evals for start and stop are working fine but the eval for difftime is not working. As I'm using strftime how can i calculate the duration between the 2 dates and times?

Tags (2)
0 Karma
Highlighted

Re: calculate difference between 2 dates and times with strftime

SplunkTrust
SplunkTrust

Splunk cannot do calculations on dates in string form. They must be converted to epoch (integer) form using strptime first. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval diffTime=stop - start
| eval start=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval stop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: calculate difference between 2 dates and times with strftime

Builder

You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this:

index=cd  source=jenkins pr_number=*
| stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage
| eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p") 
| eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p")
| eval diffTime=stop - start

This will give you diffTime in seconds, which you can do with what you want.

0 Karma