topic Re: Trying to find average between two columns time in Getting Data In

Trying to find average between two columns time

teegarden7070 — Tue, 22 Jun 2021 19:06:36 GMT

index=phantom_container AND owner!=null AND close_time!=null
| eval st=strptime(create_time, "%Y-%m-%dT%H:%M:%S")
| eval et=strptime(close_time, "%Y-%m-%dT%H:%M:%S")
| eval Dur=(et-st)/60
|table create_time close_time Dur id container_label owner_name

Here is the basic search, now I would like to find the average amount of time between create_time and close_time per owner_name.

Re: Trying to find average between two columns time

ITWhisperer — Tue, 22 Jun 2021 19:19:02 GMT

index=phantom_container AND owner!=null AND close_time!=null | eval st=strptime(create_time, "%Y-%m-%dT%H:%M:%S") | eval et=strptime(close_time, "%Y-%m-%dT%H:%M:%S") | eval Dur=(et-st)/60 |table create_time close_time Dur id container_label owner_name | stats avg(Dur) as average by owner_name

Re: Trying to find average between two columns time

teegarden7070 — Tue, 22 Jun 2021 23:06:31 GMT

Thank you!