Splunk Search

calculate hours difference between times

Dassari
New Member

I want to calculate the hours difference between two times, I am using the below search command but its not working, please help to correct my search command

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval diff = endTime - startTime
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Timestamps can only be compared in epoch form. Try this.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, Karma would be appreciated.

jplumsdaine22
Influencer

Doesn't convert mktime create epoch fields?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes, that third pipe turns any field that ends with "Time" (*Time) into an epoch time field.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're right. Correcting the time format in the convert command should be enough. If it still doesn't work then this alternative should.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, Karma would be appreciated.
0 Karma

jplumsdaine22
Influencer

Your timeformat parameter does not match your time format. Try timeformat="%Y-%m-%dT%H:%M:%SZ"

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...