Hi all.
I have two fields, in
with values like 2015-08-04 05:52:42 and out
with values like "2015-08-04 06:18:30" in the same record.
in = 2015-08-04 05:52:42
out = 2015-08-04 06:18:30
I need to calculate the time difference between out and in. I am using:
... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= goout - comein
I have a resulting field called diff with the time difference in epoch time (is a relative time like 226.000000).
I tried to convert this to human readable format using:
... | convert timeformat="%M:%S" ctime(diff)
But the resulting value doesn't properly convert the quantity in hours, only minutes and secs. Any way to show the difference like 20h,20m,20secs for example?
Thanks!
Try something like this
... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= tostring(goout - comein,"duration")
Try something like this
... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= tostring(goout - comein,"duration")
Works great, thanks!
Hi @changux
I think you forgot the %H in your timeformat conversion. so it should be:
... | convert timeformat="%H:%M:%S" ctime(diff)
Thanks Pablo. When I add the %H, returned in this case 19H, when the difference is less than 1 h, why?
ah sorry for the delayed response. not sure actually, but I'm glad you got a working answer from @somesoni2 🙂