We have the following code:
| stats count min(_time) as min, max(_time) as max by src, ....
| eval delta = (max - min)/(60*60*24)
How can we present this delta
field as, let's say - 3 days, 2 hours, 16 minutes ?... or any other human readable way.
this answer is wrong. you are trying to strftime from milliseconds. although the result will show readable format, the values are invalid.
Hi danielbb, try: | makeresults | eval mintime=1570466331.984 | eval maxtime=32890568331.784 | eval stime= round(maxtime-mintime,0) | eval timestr=strftime(stime,"%j days, %H hours, %M minutes, %S seconds")