Getting Data In

How do I calculate the difference between these two dates that are not in _time ?

lucasdc
New Member

Hi splunkers!

I have tried to calculate the difference between these two dates (Date Closed) - (Date Created) using eval's , but it's still not working.

I tried to use timestamp as well and I didn't have the results that I want to.

PS** These two fields are not in _time I uploaded the data base as CSV just like in Excel, both are recognized by splunk as strings.

alt text

0 Karma

koshyk
Super Champion

Please find attached

|makeresults 
| eval Date_Created="25/3/19 14:45" | eval Date_Closed="3/5/19 15:50" 
| eval Date_Created=strptime(Date_Created,"%e/%m/%y %H:%M")
| eval Date_Closed=strptime(Date_Closed,"%e/%m/%y %H:%M")
| eval timeDiff_secs=Date_Closed-Date_Created

Logic is to convert to epoch time and subtract

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...