hi @karunagaraprabh, You can extract each job and then use spath to extract key-value pairs. See if this works for you. | rex max_match=0 "(?<event>\<job\>[^\?]+?\<\/job\>)" | mvexpand event | spath input=event | rename job.startrange.* as *, *.* as *_* | table job_id, sideA*, sideB*   If this reply helps you, a like would be appreciated. ... View more

Hi @karunagaraprabh , as I said, if you have a multivalue field, you cannot do calculations, so you have to define if you want to take for calculation one of the epochtimes (e.g. the first one) or split your event in as many events as the number of values in printedA_epoch. In the first case use something like my above hint: your_search | rename ... | rex field=printedA_epoch "^(?<printedA_epoch>\d+)" | eval indextime=_indextime | eval fdata=round(((indextime-printedA_epoch)/86400),0) | eval diffdata=indextime-printedA_epoch | table indextime ... in the second case, try something like this: your_search | spath | rename jobs.job.job-manifest.end-range.side-a.printed-timestamp AS printedA_timestamp | eval printedA_epoch=strptime(printedA_timestamp,"%Y-%m-%dT%H:%M:%S.%3N-%z") | mvexpand printedA_epoch | eval indextime=_indextime | eval fdata=round(((indextime-printedA_epoch)/86400),0) | eval diffdata=indextime-printedA_epoch | table indextime printedA_epoch fdata diffdata Ciao. Giuseppe ... View more

I just saw that you basically assked the question twice.  https://community.splunk.com/t5/Splunk-Search/How-to-find-the-no-of-days-different-between-indexed-date-time/td-p/505761/jump-to/first-unread-message You are on a good way with Giuseppe, so maybe you want to remove this duplicate. ... View more

Hi @bowesmana , really appreciate your multiple solution, after implementing am getting Aepoch vales as 0000 instead of its value..   Thanks, Karuna     ... View more

| makeresults | eval epoch=strptime("2020-06-20T01:23:23.693-0700","%FT%T.%3Q%z") https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables   now() is epoch. please try this query. ... View more