Remove T ffrom the timestamp and find the different two different time column

[ravir_jbp]

Able to get event output in table format. But looking for eval condition:

1. Remove T from the timestamp and convert the below UTC/GMT to EST and need this in YYYY-MM-DD HH:MM:SS

2. And need the time different between c_timestamp and c_mod and add the time difference in Timetaknen column.

[ITWhisperer]

Change your global time zone to be your local time zone e.g. EST.

To calculate differences in times you need to parse the strings to epoch format

| eval epoch_timestamp=strptime(c_timestamp,"%FT%T.%6N%z")
| eval local_timestamp=strftime(epoch_timestamp,"%F %T.%6N %Z")
| eval epoch_mod=strptime(c_mod,"%FT%T.%6N%z")
| eval local_mod=strftime(epoch_mod,"%F %T.%6N %Z")
| eval diff=epoch_mod-epoch_timestamp