Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- time difference issue
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
start_time = > 2014-02-13T22:57:15+0900
end_ time = > 2014-02-13T23:59:54+0900
how can i get the time difference ??
i tried
convert timeformat="%Y/%m/%d %H:%M:%S" mktime(start_time) AS StartTime_epoch mktime(end_time) AS ResolvedTime_epoch | eval total=round((ResolvedTime_epoch-StartTime_epoch)/60/60/24)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this,
your_base_search
| eval epoch_st = strptime(start_time, "%Y-%m-%dT%H:%M:%S%z")
| eval epoch_et = strptime(end_time, "%Y-%m-%dT%H:%M:%S%z")
| eval epoch_diff = epoch_et - epoch_st
| eval dur=tostring(epoch_diff, "duration")
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this,
your_base_search
| eval epoch_st = strptime(start_time, "%Y-%m-%dT%H:%M:%S%z")
| eval epoch_et = strptime(end_time, "%Y-%m-%dT%H:%M:%S%z")
| eval epoch_diff = epoch_et - epoch_st
| eval dur=tostring(epoch_diff, "duration")
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
oh well, if your fields are actually called start_time and end_time, the new fields should come out fine. However, they do not show in the event text (_raw), but you can use them in tables, charts, stats etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i tried but epoch_st epoch_et, epoch_diff , dur field is not comming out ..
it's showing the _raw data...
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
