I need to be able to calculate the time difference between two dates and everytime i try anything...it returns blank
my search looks like this...
StartTime ResolvedTime
11/1/2012 9:35:45 AM 11/3/2012 9:35:45 AM
All i want to do is have the search return a result with the time difference between StartTime and ResolvedTime. So basically TimeToResolve should be 48 hours, 0 minutes, 0 seconds.
Please Help me...
Thanks
| convert timeformat="%m/%e/%Y %I:%M:%S %p" mktime(StartTime) AS StartTime_epoch mktime(ResolvedTime) AS ResolvedTime_epoch | eval age=round((ResolvedTime_epoch-StartTime_epoch)/60/60/24)