Adding miliseconds to "duration"

[Aqawelska]

Hi all ,

I got this search query which checks the time difference between two events and it works great but I would like also to see the milliseconds of that calculation but at the moment it just shows H:MM:SS

"Duration" is which shows me the output from a toString eval but I would like it to show also milliseconds , anyone could help me out on this one ?

index="0200-pio_numb3r5_support-app" "HumanResourceImportJob" AND "transitioning from state 'Processing' to 'Succeeded'. Reason:" OR "transitioning from state 'Enqueued' to 'Processing'. Reason:" AND NOT OnStateUnapplied
| where host="AUDIINSA4919" OR host="AUDIINSA4304"
| stats 
     earliest(_time) AS Start_time 
     latest(_time) AS Finished_time 
     by host
| eval Latency=tostring(Finished_time-Start_time, "duration")<----- here
| table Start_time , Finished_time , Latency , host
| fieldformat Finished_time=strftime(Finished_time,"%d/%m/%y %H:%M:%S.%3N")
| fieldformat Start_time=strftime(Start_time,"%d/%m/%y %H:%M:%S.%3N")

Output is (latency should be H:MM:SS:milliseconds) :

  Start_time                                   Finished_time                            Latency           host

1

19/05/22 03:30:03.000

19/05/22 03:42:02.000

00:11:59

AUDIINSA4919

[ITWhisperer]

Try this

| eval Latency=tostring(Finished_time-Start_time+0.000, "duration")