All Apps and Add-ons

Splunk Calculating Time Difference

anitaroseline
New Member

Dear All,

I need to calculate time difference for 2 time stamps as below:

alt text

Query:
source="E:\Data Upload to Splunk\CSL_KM_Reports\EMAIL\test.csv" host="DE2VS567" index="csl_km" sourcetype="csv" date_month="october" | eval field=split(Subject,"DEOLYCLO02") | rename field as "EmailRecTime" ,date_month as Month | eval earliesttime=strptime(EmailRecTime,"%d/%m/%Y %H:%M:%S")| eval latesttime=strptime(Date,"%d/%m/%Y %H:%M:%S") | eval diff = tostring(earliesttime-latesttime,"duration")| eval diff1 = round(diff/60/60/24) | eval duration2=replace(diff,"(\d*)+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") | eval status_code=case(diff>="00:02:00.000000", "NOTMET" ,diff<="00:02:00.000000", "MET") | table ClusterName,Month,EmailRecTime,Date,latesttime,earliesttime,diff,duration2,status_code

My first column has earliest time to be less that latestime and Diff output is blank.Please help on this.

Tags (1)
0 Karma

kmaron
Motivator

If you subtract the latesttime from the earliesttime as per your search it returns a negative number. That's why you're not getting a duration.

0 Karma

anitaroseline
New Member

Thanks i have fixed it

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...