I want to calculate the hours difference between two times, I am using the below search command but its not working, please help to correct my search command
| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval diff = endTime - startTime
Timestamps can only be compared in epoch form. Try this.
| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
Doesn't convert mktime create epoch fields?
Yes, that third pipe turns any field that ends with "Time" (*Time) into an epoch time field.
You're right. Correcting the time format in the convert
command should be enough. If it still doesn't work then this alternative should.
| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch
Your timeformat parameter does not match your time format. Try timeformat="%Y-%m-%dT%H:%M:%SZ"