topic Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events? in Getting Data In

Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events?

sumanssah — Tue, 29 Sep 2020 15:30:00 GMT

Hi All
I want to extract result for period of co-relation rule i.e:

"dispatch.earliest_time" - "dispatch.latest_time"

Example :
dispatch.earliest_time = "63m@m"
dispatch.latest_time = "3m"

Required result is "63m@m" - "3m" = 60m

Thanks in advance.

Re: Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events?

DalJeanis — Wed, 23 Aug 2017 23:46:45 GMT

If you are doing it inside a search, you can do this to get the range in seconds between earliest and latest for the search.

| addinfo
| eval result = info_max_time - info_min_time 
| eval resultMin = round(result/60)

Re: Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events?

sumanssah — Thu, 24 Aug 2017 07:36:20 GMT

Thanks for response.
I tried you suggestion, however getting below mentioned error

Error in 'eval' command: Typechecking failed. '-' only takes numbers.

Re: Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events?

DalJeanis — Tue, 29 Sep 2020 15:25:51 GMT

That's because you have no upper bound on the time, so info_max_time has a value that is represented as "+infinity". I've added makeresults onto the front for testing.

 | makeresults 
 | addinfo
 | eval result = if(isnum(info_max_time),info_max_time,now()) - info_min_time  
 | eval resultMin = round(result/60)

The above assumes there are no future-dated transactions in the results. If future-dated events are possible, then you can do something like this...

 | makeresults 
 | eval _time = relative_time(_time,"+2d@d")
 | rename COMMENT as "The above just creates test data with future dates."

 | rename COMMENT as "Get the highest event date/time, and get the time range from the search."
 | eventstats max(_time) as maxtime 
 | addinfo
 | rename COMMENT as "Calculate time range from the search (if not all time), using the maximum event _time if it is future , else use now()."
 | eval result = case(isnum(info_max_time),info_max_time,  maxtime>now(),maxtime,  true(),now()) - info_min_time  
 | eval resultMin = round(result/60)