Splunk Search

Calculate Date Diff - two different events in the two different sourcetypes

erick_costa
Path Finder
sourcetype=teste1
============================
code, datahora
_________________
1, 2013-05-07 15:51:13.772

sourcetype=teste2
============================
code, datahora
_________________
1, 2013-05-07 15:55:13.060
Tags (2)
0 Karma

aholzer
Motivator

Perform an eval "strptime" on both dates, or a convert with timeformat, then simply use another eval to do the subtraction.

Something like this from this answer (http://splunk-base.splunk.com/answers/10021/delta-between-two-date-data-fields):
...| convert timeformat='%m-%d-%Y %T' mktime(starttime) mktime(endtime) | eval duration=(endtime-starttime)/86400

There are quite a few different ways to do it. If you search for "splunk difference between two dates", or "splunk subtracting two dates" or similar, you should get quite a few answers to your question.

erick_costa
Path Finder

How to calculate datediff?

0 Karma

Ayn
Legend

Yes? Did you have a question?

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...