I have the following data indexed:
initialTime Purchase_Time
2011-11-04T13:17Z 2011-11-04 09:18:20
2011-11-04T21:08Z 2011-11-04 14:08:28
2011-11-04T15:16Z 2011-11-04 16:38:16
2011-11-04T15:15Z 2011-11-04 10:18:12
2011-11-04T21:25Z 2011-11-04 14:26:40
2011-11-04T13:35Z 2011-11-04 09:36:45
2011-11-04T20:01Z 2011-11-04 16:03:02
2011-11-04T19:31Z 2011-11-04 20:28:55
I tried to get the following result set with a splunk query:
|eval Time_Diff = initialTime - Purchase_Time
But I have not been able to...
Thanks.
This should give you the difference in seconds.
| eval itime=strptime(initialTime,"%Y-%m-%dT%H:%M") | eval ptime=strptime(PurchaseTime,"%Y-%m-%d %H:%M:%S") | eval TimeDiff=itime-ptime | table initialTime PurchaseTime TimeDiff
Splunk (by default) parses out the first timestamp it sees from an event (well, it could be a different timestamp if you configure it this way) and stores it in time_t
format as the field _time
. But, it does not do this by default with any additional timestamp-looking data within the event.
Ipolo, the reason this works where your initial approach didn't is because the example field values from your search are just strings. Splunk doesn't know how to subtract them and make sense of them. What eelisio is doing is converting the timestamp strings to time_t
values (that is, the number of seconds since 1/1/1970 00:00:00 UTC). The time_t
format (sometimes called epoch time) is really awesome because you can store large time ranges in simple 32-bit values, and because you can easily figure out the delta between any two timestamps via addition/subtraction.