On my current data I have two date fields: CommencementDate and CompletitionDate.
I would like to build a chart where the timestamp would be CompletitionDate - CommencementDate. For that, I created the query below:
| eval InspectionDate=strptime(CompletionDate, ā%Y-%m-%dT%H:%M:%Sā)-strptime(CommencementDate, ā%Y-%m-%dT%H:%M:%Sā) |
The date format is: 2015-01-27T06:00:00
Could someone please advise?
You almost had it. Once you subtract the respective epoch times you just need to put the result back into text form.
... | eval InspectionDate=strftime(strptime(CompletionDate, ā%Y-%m-%dT%H:%M:%Sā)-strptime(CommencementDate, ā%Y-%m-%dT%H:%M:%Sā), "%Y-%m-%dT%H:%M:%S") | ...
You almost had it. Once you subtract the respective epoch times you just need to put the result back into text form.
... | eval InspectionDate=strftime(strptime(CompletionDate, ā%Y-%m-%dT%H:%M:%Sā)-strptime(CommencementDate, ā%Y-%m-%dT%H:%M:%Sā), "%Y-%m-%dT%H:%M:%S") | ...
Hi richgalloway (:
I did try using the updated query you provided me, but Iām still not getting any results for InspectionTime... any other inputs? š