Splunk Search

calculate hours difference between times

Dassari
New Member

I want to calculate the hours difference between two times, I am using the below search command but its not working, please help to correct my search command

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval diff = endTime - startTime
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Timestamps can only be compared in epoch form. Try this.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, Karma would be appreciated.

jplumsdaine22
Influencer

Doesn't convert mktime create epoch fields?

0 Karma

DalJeanis
Legend

Yes, that third pipe turns any field that ends with "Time" (*Time) into an epoch time field.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're right. Correcting the time format in the convert command should be enough. If it still doesn't work then this alternative should.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
---
If this reply helps you, Karma would be appreciated.
0 Karma

jplumsdaine22
Influencer

Your timeformat parameter does not match your time format. Try timeformat="%Y-%m-%dT%H:%M:%SZ"

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...