I would like to show the HH:MM of my search as a field in a table. How can I set that up as a field?
Like this
your base search | eval time=strftime(_time, "%H:%M") | table _time time
*UPDATED based on comment*
your base search | addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | table dur*
Like this
your base search | eval time=strftime(_time, "%H:%M") | table _time time
*UPDATED based on comment*
your base search | addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | table dur*
Perfect! That worked great!
actually displaying this in seconds would work better.
So you want to display the duration of the search? Are you displaying it in a dashboard?
So if I do a search from 8AM to 9AM I would like to see the difference in seconds, 3600
Aha.. see updated answer below..