Knowledge Management

Time difference between 2 fields

nathanluke86
Communicator

How can I get the time difference between two fields below

alt text

TIA

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Like this.. This will convert your fields to epoch time, find the difference, then convert to hours/min/sec

| eval time_epoch=strptime(time, "%m/%d/%y %H:%M:%S")
| eval timenow_epoch=strptime(timenow, "%m/%d/%y %H:%M:%S")
| eval diff=timenow_epoch-time_epoch
| eval diff=strftime(diff, "%H:%M:%S")

View solution in original post

manjunathmeti
Champion

Use:

| eval time_diff = strptime(timenow, "%m/%d/%y %H:%M:%S") - strptime(time, "%m/%d/%y %H:%M:%S")

Sample query:

| makeresults | eval time="02/18/20 12:00:45",  timenow="02/18/20 14:12:32" | eval time_diff = strptime(timenow, "%m/%d/%y %H:%M:%S") - strptime(time, "%m/%d/%y %H:%M:%S")

nathanluke86
Communicator

Thanks @manjunathmeti

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this.. This will convert your fields to epoch time, find the difference, then convert to hours/min/sec

| eval time_epoch=strptime(time, "%m/%d/%y %H:%M:%S")
| eval timenow_epoch=strptime(timenow, "%m/%d/%y %H:%M:%S")
| eval diff=timenow_epoch-time_epoch
| eval diff=strftime(diff, "%H:%M:%S")

View solution in original post

nathanluke86
Communicator

Thankyou @skoelpin

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!