I have a timestamp in EST and one from any other non-EST timezone how do I calculate the elapsed time between them both?
Hey
Test this solution. You just need to figure out which are the TZ syntax Splunk allows:
| makeresults
| eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
| eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z")
| eval t3=t2-t1
Then do the difference of the two fields and voilá
Hey
Test this solution. You just need to figure out which are the TZ syntax Splunk allows:
| makeresults
| eval t1="2017-03-15 10:00:00 CET" , t2="2017-03-15 10:00:00 GMT"
| eval t1=strptime(t1,"%Y-%m-%d %H:%M:%S %Z") , t2=strptime(t2,"%Y-%m-%d %H:%M:%S %Z")
| eval t3=t2-t1
Then do the difference of the two fields and voilá
Absolutely!! Thanks again. I'm new to this and I am upvoting it now.
This looks like it should work & thank you for your answers. I was not sure how to pass the timezone, however your answer is very illustrative and I appreciate it.
No problem. If the answer is correct please don't forget to upvote it and accept
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
Can anyone show me an example? Should I append the TimeZone code "EST" or "CST" or "PST" as the suffix on the TIMESTAMP I am using STRPTIME to convert?
Use the epoch of both your timestamps. As it is universal, you'll get accurate and correct results.
Basically you just need to make sure they are both timestamps and do one minus the other because splunk automatically interprets then as epoch time