Getting Data In

Subtracting two timestamps returning incorrect difference?

xoamanda12xo
Explorer

I am using the splunk field: _time and subtracting my own time field: open_date from the time field. The goal is to get the difference between these two time stamps. For example, one entry in the _time field is: "2021-03-11 11:17:13" and one entry in the open_date field is: "2021-06-07T14:50:42".

 

I am running the current query operations:

| eval difference = abs(_time - strptime(open_date, "%Y-%m-%dT%H:%M:%S")) | eval difference = strftime(difference,"%Y-%m-%dT%H:%M:%S")

When running this for the above example entries I get a difference output of "1970-03-29T20:10:19",  which is obviously incorrect. What am I doing wrong and how can I get the correct difference between these two fields?

Labels (4)
0 Karma

astackpole
Path Finder

I would try this:

| eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S")
| eval open_date = (strptime(open_date, "%Y-%m-%dT%H:%M:%S")
| eval diff = abs(mytime - open_date) 
| eval difference = strftime(diff,"%Y-%m-%dT%H:%M:%S")

 When you call the _time variable by default it is in UTC so you need to format both fields before running the final equation. Please upvote if this helps! 🙂 

0 Karma

xoamanda12xo
Explorer

That didn't return any results for me 😞 

0 Karma

astackpole
Path Finder

Try this! Using now() instead of _time works a lot better from my experience. I was able to test this too so let me know if this works for you then!

 

| makeresults
| eval open_date = "2021-06-07T14:50:42"
| eval open=strptime(open_date, "%F")
| eval days=round((now()-open),0)
| table open open_date _time days

 

Here's another Splunk Answer I found that may be helpful too! https://community.splunk.com/t5/Splunk-Search/Compare-a-date-field-with-current-date/m-p/65056

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...