host y contain name tag: ELT (Value: milliseconds)
host x contain name tag: ELT (Value: seconds)
Common identifier in the two hosts are F5I
How do I calculate the difference between ELT in host Y and ELT in host X?
I have tried this search:
host=x | JOIN F5I [ search host=y ]|EVAL yELT=ELT/1000 |TABLE host SVC ELT yELT
But the value of 'ELT' above is the value of ELT in host Y - and I want the value of ELT in host X - in order to calculate the difference - how do I do that?
Thanks in advance for any help.
found the solution myself!
Put a rename ELT AS YELT into the subsearch - then I can get both the ELT from x and ELT from y
- and thereby calculate the difference between yELT and xELT
host=x | JOIN F5I [ search host=y |rename ELT AS YELT ] |TABLE host SVC ELT YELT