Getting Data In

Subtracting two timestamps returning incorrect difference?

xoamanda12xo
Explorer

I am using the splunk field: _time and subtracting my own time field: open_date from the time field. The goal is to get the difference between these two time stamps. For example, one entry in the _time field is: "2021-03-11 11:17:13" and one entry in the open_date field is: "2021-06-07T14:50:42".

 

I am running the current query operations:

| eval difference = abs(_time - strptime(open_date, "%Y-%m-%dT%H:%M:%S")) | eval difference = strftime(difference,"%Y-%m-%dT%H:%M:%S")

When running this for the above example entries I get a difference output of "1970-03-29T20:10:19",  which is obviously incorrect. What am I doing wrong and how can I get the correct difference between these two fields?

Labels (4)
0 Karma

astackpole
Path Finder

I would try this:

| eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S")
| eval open_date = (strptime(open_date, "%Y-%m-%dT%H:%M:%S")
| eval diff = abs(mytime - open_date) 
| eval difference = strftime(diff,"%Y-%m-%dT%H:%M:%S")

 When you call the _time variable by default it is in UTC so you need to format both fields before running the final equation. Please upvote if this helps! 🙂 

0 Karma

xoamanda12xo
Explorer

That didn't return any results for me 😞 

0 Karma

astackpole
Path Finder

Try this! Using now() instead of _time works a lot better from my experience. I was able to test this too so let me know if this works for you then!

 

| makeresults
| eval open_date = "2021-06-07T14:50:42"
| eval open=strptime(open_date, "%F")
| eval days=round((now()-open),0)
| table open open_date _time days

 

Here's another Splunk Answer I found that may be helpful too! https://community.splunk.com/t5/Splunk-Search/Compare-a-date-field-with-current-date/m-p/65056

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...