My timestamp-in and timestamp-out fields are in this format 2018-07-23T15:53:11.588Z how do i calculate duration ? i am calculating latency in time i.e response code .
i tried |eval tin=substr(tostring(timestamp-in),12,23) and also strptime
Anyone can help ?
Try like this
your current search | eval latency=strptime('timestamp-out',"%Y-%m-%dT%H:%M:%S.%3N%Z")-strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%3N%Z")