I have two time fields in a single event that I need to calculate the difference between and then display said difference in a table.
The two fields and time formats are below:
Time Created - Wed, 18 Dec 2019 19:23:56 -0500
Time Assigned - Wed, 18 Dec 2019 19:36:00 -0500
I would also like to then display the average of the difference for the other events, for example, if I have 10 events, I'd like the average time of the 10 differences.
Thanks in advance.
Hi @migquinn,
for first question you have to convert dates in epochtime using eval command and strptime funcion, but first rename fileds without spaces:
your_search
| rename "Time Created" AS Time_Created "Time Assigned" AS Time_Assigned
| eval diff=strptime(Time_Created,"%a, %d %b %Y %H:%M:%S %z") - strptime(Time_Assigned,"%a, %d %b %Y %H:%M:%S %z")
| table Time_Created Time_Assigned diff
About the average:
your_search
| rename "Time Created" AS Time_Created "Time Assigned" AS Time_Assigned
| eval diff=strptime(Time_Created,"%a, %d %b %Y %H:%M:%S %z") - strptime(Time_Assigned,"%a, %d %b %Y %H:%M:%S %z")
| stats avg(diff) AS Average
Ciao.
Giuseppe
Hi @migquinn,
for first question you have to convert dates in epochtime using eval command and strptime funcion, but first rename fileds without spaces:
your_search
| rename "Time Created" AS Time_Created "Time Assigned" AS Time_Assigned
| eval diff=strptime(Time_Created,"%a, %d %b %Y %H:%M:%S %z") - strptime(Time_Assigned,"%a, %d %b %Y %H:%M:%S %z")
| table Time_Created Time_Assigned diff
About the average:
your_search
| rename "Time Created" AS Time_Created "Time Assigned" AS Time_Assigned
| eval diff=strptime(Time_Created,"%a, %d %b %Y %H:%M:%S %z") - strptime(Time_Assigned,"%a, %d %b %Y %H:%M:%S %z")
| stats avg(diff) AS Average
Ciao.
Giuseppe
Hi Giuseppe,
Thank you very much, this worked a charm!