I have a table that has batch ID, start & end time of each batch. How can I get the duration i.e. runtime of each batch.

[cadrija]

I have a table that has batch ID, start & end time of each batch. How can I get the duration i.e. runtime of each batch.

When I am running this query then the duration field is coming blank.

index="bodata" | where BEX_TSP_START!="NULL" AND BEX_TSP_END!="NULL" | where BEX_DTE_BSNS=="09-12-2021" | eval Duration=strptime(BEX_TSP_END,"%H:%M.%S")-strptime(BEX_TSP_START,"%H:%M.%S") | table BEX_NUM_JOB,Duration

Please help.

[ITWhisperer]

The "times" in your image do not contain hours which is why the strptime is failing. Do your events have the full date and time in some other field that you could use?

[cadrija]

@ITWhisperer Okay, got it let me check how to get the full date time.
Thank you.