Calculating the time difference between fields, how do I properly convert the resulting value to a human readable format?

[changux]

Hi all.

I have two fields, in with values like 2015-08-04 05:52:42 and out with values like "2015-08-04 06:18:30" in the same record.

in = 2015-08-04 05:52:42
out = 2015-08-04 06:18:30

I need to calculate the time difference between out and in. I am using:

... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= goout - comein

I have a resulting field called diff with the time difference in epoch time (is a relative time like 226.000000).

I tried to convert this to human readable format using:

... | convert timeformat="%M:%S" ctime(diff)

But the resulting value doesn't properly convert the quantity in hours, only minutes and secs. Any way to show the difference like 20h,20m,20secs for example?

Thanks!

[somesoni2 · Accepted solution]

Try something like this

 ... | eval comein=strptime(in,"%Y-%m-%d %H:%M:%S") | eval goout=strptime(out,"%Y-%m-%d %H:%M:%S") | eval diff= tostring(goout - comein,"duration")

[changux]

Works great, thanks!

[ppablo]

Hi @changux

I think you forgot the %H in your timeformat conversion. so it should be:

... | convert timeformat="%H:%M:%S" ctime(diff)

[changux]

Thanks Pablo. When I add the %H, returned in this case 19H, when the difference is less than 1 h, why?

[ppablo]

ah sorry for the delayed response. not sure actually, but I'm glad you got a working answer from @somesoni2 🙂