Hello,
I want to calculate the time difference between two fields, so I tried the below query, but it didn't work.
Please correct my query.
index=service | eval Time=strptime(_time, "%Y/%m/%d %H:%M:%S") | eval LastSync=strptime(lastSync, "%Y/%m/%d %H:%M:%S") | eval diff=LastSync-Time | table _time,lastSync,diff,| sort -_time
Thank you.
... View more