How to generate a search that finds the time difference?

[sravankaripe]

i want to find the difference b/w starttime and _time.

"StartTime":"2017-02-03 09:51:54.595" (String)
EndTime:2017-02-03 09:46:21,892

Please help me with Splunk search

[aaraneta_splunk]

@sravankaripe: Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thank you.

[somesoni2]

Try like this for difference between starttime (assuming field name is StartTime) and _time (Splunk extracted event timestamp)

your base search | eval Difference=_time -strptime(StartTime, "%Y-%m-%d %H:%M:%S.%3Q") | Diff_DurationFormat=tostring(Difference,"duration")

[Richfez]

IF those are already being shown as fields StartTime and EndTime, then this should work. NOTE is EndTime really differently formatted with a comma and not a period? Not really a problem, just double-check things.

base search ... | eval ConvertedStart=strptime(StartTime, "%Y-%m-%d %H:%M:%S.%3Q")
| eval ConvertedEnd=strptime(EndTime,"%Y-%m-%d %H:%M:%S,%3Q")
| eval ElapsedTime=ConvertedEnd-ConvertedStart

From common time variable formats, eval functions for date and time.

You may or may not need the eval for Elapsed time, it depends if it is properly seen as a time or as a string. Although, the idea is likely necessary because to do math on these, you'll want to convert them to unix Epoch times, which is what we do. So they're seconds past Jan 1, 1970. You'll have to convert them back to display them better (strftime and others, also able to be found from those above links).

[GregZillgitt]

|eval start=strptime("2017-02-03 09:51:54.595","%Y-%m-%d %H:%M:%S.%3N")
|eval end=strptime("2017-02-03 09:46:21,892","%Y-%m-%d %H:%M:%S,%3N")
|eval diffInSeconds=end-start