how to find differnce between epoch

[karunagaraprabh]

When i try to find the difference between two epoc

1)find the days range i get blank values
2) and i need to filter only records where days =0

| eval printedA_epoch=strptime(printedtimestrampA,"%Y-%m-%dT%H:%M:%S.%Q"),printedB_epoch=strptime(printedtimestrampB,"%Y-%m-%dT%H:%M:%S.%Q")
| eval indextime =_indextime
| eval diffA=indextime-printedA_epoch, diffB=indextime-printedB_epoch
| eval daysA= round((diffA/86400),0) , daysB= round((diffB/86400),0)
| table host,printedA_epoch,printedB_epoch,indextime,diffA,diffB,daysA,daysB

[rnowitzki]

I just saw that you basically assked the question twice. 

https://community.splunk.com/t5/Splunk-Search/How-to-find-the-no-of-days-different-between-indexed-d...

You are on a good way with Giuseppe, so maybe you want to remove this duplicate.

[rnowitzki]

Hi @karunagaraprabh ,

Looking at your screenshot, it looks like printedA_epoch an printedA_epoch are MV (Multi Value) fields, is that correct?

So something in your SPL (that is not visible in your Screenshot) puts all the timestamps belonging to one host in a MV field. So the calculation does not work. You have to know/define which timestamp you want to calculate against the indextime, or (if you need to calculate against all) you have to change the SPL so that there is a line for each A and B timestamp pair.

We might need the full SPL and/or some sample data to help more detailed.