Hi,
I'm trying to calculate the time without errors in the system. To do that I'm doing something like
| eval now = now()
| convert timeformat="%Y-%m-%d %H:%M:%S.%3N" mktime(_time) AS epoch_time
| eval diff = now - epoch_time
| eval TimeWithoutErrors = strftime(diff,"%H:%M:%S")
| eval TimeNow = strftime(now,"%Y-%m-%d %H:%M:%S.%3N")
| eval EventTime = strftime(epoch_time,"%Y-%m-%d %H:%M:%S.%3N")
| head 1
| table TimeWithoutErrors, TimeNow, _time, EventTime
And the values I get are:
TimeNow: 2017-01-27 14:18:16.000 -> correct
_time: 2017-01-27 12:00:14.552 -> correct
EventTime: 2017-01-27 12:00:14.552 -> correct
TimeWithoutErrors: 03:18:01 -> not correct, should be one hour less
Why I'm getting an hour more that what I should get?
Thank you very much,
Vicenç
... View more