How to get elapsed time? I have the following
|eval tnow = now() |convert ctime(tnow) as currtime | eval eltime =(currtime-rtime) | table ServName rtime currtime eltime
What output are you getting? You may need to run a convert on rtime if you're not already, but something like this should work:
... | eval now = now() | eval tdelta = now - rtime | table ...