Splunk Search

Time Difference problem

abhayneilam
Contributor

Hi,

I am giving the following query :

| inputlookup file.csv | eval CT="1/24/2013 6:54" | convert timeformat="%m/%d/%Y %T" mktime("DATE LOGGED") mktime(CT) | eval duration=("DATE LOGGED"-CT)

and it is giving me :

Error in 'eval' command: Typechecking failed. '-' only takes numbers.

I simply want to find out the difference betwen the time given in one field called "DATE LOGGED" and today's date i.e., "1/24/2013" ( the date when I run my query )

Please help

Tags (3)
0 Karma

javo
Explorer

I don't know if Splunk can operate on epoch-formatted times. What I would try is to convert epochs to seconds or another duration format and then do the math. Maybe it isn't a fancy solution, but it could work.

0 Karma

abhayneilam
Contributor

That's seems good, But How to do that ?

Any Example would be highly appreciated

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...