Splunk Search

How to find the difference between timestamps in a number format that isn't based on dates?

raby1996
Path Finder

Hi all,

I'm trying to calculate the difference between two dates my search regarding this looks as follows (forgive the messiness, i know it seems a bit redundant)-

| eval it = strptime(Load_Time, "%Y/%m/%d") 
| eval ot = strptime(Time, "%Y/%m/%d %I:%M:%S") 
| eval it2 = strftime(it, "%Y/%m/%d") 
| eval ot2 = strftime(ot, "%Y/%m/%d")
| eval it3 = strptime(it2, "%Y/%m/%d")  
| eval ot3 = strptime(ot2, "%Y/%m/%d")
| eval TimeDiff=   ot3-it3 
| eval TimeDiff2=strftime(TimeDiff, "%j")|
| dedup it2, MTMS
| dedup MTMS, Time 
| sort -Load_Time 
| stats list(LIC) as LIC count list(MTMS) AS MTMS , list(it2) AS LoadTime, list(ot2) As EventDate, list(TimeDiff2) AS Time_Difference ,sum(TimeDiff2) AS Sum,  by Bundle
| eval Machine_Months=Sum/30.4
| sort -Bundle

The problem with this is that the results (difference) I'm given is in Epoch format which I can't use to do the calculations that follow (dividing the sum of all differences by 30.4) and if I use strftime to convert it, then I can only go up to 365 days (using %j ) which isn't a big enough number as some of these differences go beyond that, and for the dates that are the same, lets say 2015/07/09 and 2015/07/09 I get 365 instead of 0

So my overall goal is to get a difference between these dates in a number format that isn't based on dates (so 0 to infinity NOT 0 to 365 or 0 to 31 etc...)
Thank you!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To get the time difference in days, divide epoch time by 86400.

| eval TimeDiff2=TimeDiff/86400
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To get the time difference in days, divide epoch time by 86400.

| eval TimeDiff2=TimeDiff/86400
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...