All Apps and Add-ons

Splunk Calculating Time Difference

anitaroseline
New Member

Dear All,

I need to calculate time difference for 2 time stamps as below:

alt text

Query:
source="E:\Data Upload to Splunk\CSL_KM_Reports\EMAIL\test.csv" host="DE2VS567" index="csl_km" sourcetype="csv" date_month="october" | eval field=split(Subject,"DEOLYCLO02") | rename field as "EmailRecTime" ,date_month as Month | eval earliesttime=strptime(EmailRecTime,"%d/%m/%Y %H:%M:%S")| eval latesttime=strptime(Date,"%d/%m/%Y %H:%M:%S") | eval diff = tostring(earliesttime-latesttime,"duration")| eval diff1 = round(diff/60/60/24) | eval duration2=replace(diff,"(\d*)+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") | eval status_code=case(diff>="00:02:00.000000", "NOTMET" ,diff<="00:02:00.000000", "MET") | table ClusterName,Month,EmailRecTime,Date,latesttime,earliesttime,diff,duration2,status_code

My first column has earliest time to be less that latestime and Diff output is blank.Please help on this.

Tags (1)
0 Karma

kmaron
Motivator

If you subtract the latesttime from the earliesttime as per your search it returns a negative number. That's why you're not getting a duration.

0 Karma

anitaroseline
New Member

Thanks i have fixed it

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...