Getting Data In

How do I calculate elapsed time difference between timestamps that are from different timezones?

timothytruax
Explorer

I have a timestamp in EST and one from any other non-EST timezone how do I calculate the elapsed time between them both?

0 Karma
1 Solution

tiagofbmm
Influencer

Hey

Test this solution. You just need to figure out which are the TZ syntax Splunk allows:

| makeresults 
    | eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
    | eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z") 
| eval t3=t2-t1

Then do the difference of the two fields and voilá

View solution in original post

tiagofbmm
Influencer

Hey

Test this solution. You just need to figure out which are the TZ syntax Splunk allows:

| makeresults 
    | eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
    | eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z") 
| eval t3=t2-t1

Then do the difference of the two fields and voilá

timothytruax
Explorer

Absolutely!! Thanks again. I'm new to this and I am upvoting it now.

0 Karma

timothytruax
Explorer

This looks like it should work & thank you for your answers. I was not sure how to pass the timezone, however your answer is very illustrative and I appreciate it.

0 Karma

tiagofbmm
Influencer

No problem. If the answer is correct please don't forget to upvote it and accept

0 Karma

tiagofbmm
Influencer

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

0 Karma

timothytruax
Explorer

Can anyone show me an example? Should I append the TimeZone code "EST" or "CST" or "PST" as the suffix on the TIMESTAMP I am using STRPTIME to convert?

0 Karma

tiagofbmm
Influencer

Use the epoch of both your timestamps. As it is universal, you'll get accurate and correct results.

Basically you just need to make sure they are both timestamps and do one minus the other because splunk automatically interprets then as epoch time

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...