how to convert time format in search query

[kirrusk]

could someone please help me to convert the time format.

time: Thu jul 20 18:49:57 2020  (string type)

i'm trying to get 2020-07-20 18:49:57

i want final result to  get diff between two dates , like  2020-07-20 18:49:57 -  2020-07-21 18:49:57 (in days)

[richgalloway · Accepted solution]

To convert time strings into a different format, use a combination of strptime() and strftime().

... | eval newFormat=strftime(strptime(oldformatfield, "%a %b %d %H:%M:%S %Y"), "%Y-%m-%d %H:%M:%S")

To get the difference between two dates, however, you must use the parsed (epoch) form.

... | eval diff = strptime(oldformatfield1, "%a %b %d %H:%M:%S %Y") - strptime(oldformatfield2, "%a %b %d %H:%M:%S %Y")

[kirrusk]

can u please suggest how to convert the diff values to days

[richgalloway]

Let eval do the math for you.

| eval days = diff / 86400