time difference between two fields

[selvam_sekar]

Hi,

I have two fields, where time zone seems to be different.. please could you help me to get difference ? 

itime= 2024-02-22 20:56:02,185

stime=2024-02-23T01:56:02Z

I tried the below but it always gives around 5 hrs delay..

SPL:

| eval itime=strptime(Initial_Time,"%Y-%m-%d %H:%M:%S,%3N")
| eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S")
| eval difference = abs(itime - stime)
| eval time_difference=tostring(difference, "duration")

[richgalloway]

Have you tried incorporating the time zone in the strptime call?

| eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S%Z")