Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events?

[sumanssah]

Hi All
I want to extract result for period of co-relation rule i.e:

"dispatch.earliest_time" - "dispatch.latest_time"

Example :
dispatch.earliest_time = "63m@m"
dispatch.latest_time = "3m"

Required result is "63m@m" - "3m" = 60m

Thanks in advance.

[DalJeanis]

If you are doing it inside a search, you can do this to get the range in seconds between earliest and latest for the search.

| addinfo
| eval result = info_max_time - info_min_time 
| eval resultMin = round(result/60)

[sumanssah]

Thanks for response.
I tried you suggestion, however getting below mentioned error

Error in 'eval' command: Typechecking failed. '-' only takes numbers.

[DalJeanis]

That's because you have no upper bound on the time, so info_max_time has a value that is represented as "+infinity". I've added makeresults onto the front for testing.

 | makeresults 
 | addinfo
 | eval result = if(isnum(info_max_time),info_max_time,now()) - info_min_time  
 | eval resultMin = round(result/60)

The above assumes there are no future-dated transactions in the results. If future-dated events are possible, then you can do something like this...

 | makeresults 
 | eval _time = relative_time(_time,"+2d@d")
 | rename COMMENT as "The above just creates test data with future dates."

 | rename COMMENT as "Get the highest event date/time, and get the time range from the search."
 | eventstats max(_time) as maxtime 
 | addinfo
 | rename COMMENT as "Calculate time range from the search (if not all time), using the maximum event _time if it is future , else use now()."
 | eval result = case(isnum(info_max_time),info_max_time,  maxtime>now(),maxtime,  true(),now()) - info_min_time  
 | eval resultMin = round(result/60)