To find the difference of time between 2 timestamp fields

[Real_captain]

Hi 

Can you please let me know how we can find the difference of time between 2 timestamp fields.

For example, 2 timestamp fields are in the below format: 

Reception_Time = 06/21/2024 08:58:00.000000 

Processing_End_Time = 06/21/2024 09:52:55.000000

Query : 

(index="events_prod_gmh_gateway_esa") SPNLDSCR2406210858000001000 | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM
|eval Time_in = "20" + substr(sRefInt , 9 , 15)
|eval Processing_Start_Time = strptime(HdtIn,"%Y%m%d%H%M%S.%q") , Processing_End_Time = strptime(HdtOut,"%Y%m%d%H%M%S.%q") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q")
|convert ctime(Processing_Start_Time) , ctime(Processing_End_Time) , ctime(Reception_Time)
| table _time , ID_FAMILLE , MSG_TYP_CONV , MSG_TYP_ORIG , sRefInt , Reception_Time , Processing_Start_Time , Processing_End_Time

[richgalloway]

You have the right idea, but the strptime format strings don't match the example data.  Then simply subtract one from the other to get the difference.  Try this

|eval Processing_Start_Time = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") , 
      Processing_End_Time = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") , 
      Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q"),
      diff = Processing_End_Time - Reception_Time

[Real_captain]

Not able to extract the difference. 

Query: 

(index="events_prod_gmh_gateway_esa") SPNLDSCR* | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM
|eval Time_in = "20" + substr(sRefInt , 9 , 15)
|eval Processing_Start_Time = strptime(HdtIn,"%Y%m%d%H%M%S.%q") , Processing_End_Time = strptime(HdtOut,"%Y%m%d%H%M%S.%q") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q")
|eval Processing_Start_Time_1 = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") ,
Processing_End_Time_1 = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") ,
Reception_Time_1 = strptime(Time_in,"%Y%m%d%H%M%S.%q"),
diff = Processing_End_Time_1 - Reception_Time_1
|convert ctime(Processing_Start_Time) , ctime(Processing_End_Time) , ctime(Reception_Time)
| table _time , ID_FAMILLE , MSG_TYP_CONV , MSG_TYP_ORIG , sRefInt , Reception_Time , Processing_Start_Time , Processing_End_Time , Processing_Start_Time_1 , Processing_End_Time_1 , Reception_Time_1 , diff

[ITWhisperer]

You are parsing HdtIn and HdtOut twice with strptime using different formats. Only one of the formats is working. Use that to parse the times into epoch format and find the difference between these times.