Date type issue on extracted fields

[clementros]

Hi all,

I have two date fields extracted (with regex) from log files.

starting_collection_timestamp = Thu Oct 17 22:40:10 GMT 2019
end_collection_timestamp = Thu Oct 17 22:40:21 GMT 2019 

I tried to know the exact type for this fields with the command :

| makeresults | eval t=typeof(starting_collection_timestamp)

Here is the result :

        _time              |            t
 2019-11-29 08:56:43                 Invalid

When i tried to calculate the elapsed time between starting_collection_timestamp and end_collection_timestamp i have an empty field.

I tried to change the type with the command strptime without sucess.

| eval strptime('starting_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y")

Thank you for your help.

[kamlesh_vaghela · Accepted solution]

@clementros

I think you should try this.

| makeresults 
| eval starting_collection_timestamp="Thu Oct 17 22:40:10 GMT 2019", end_collection_timestamp="Thu Oct 17 22:40:21 GMT 2019" 
| eval starting_collection_timestamp = strptime('starting_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y") 
| eval end_collection_timestamp = strptime('end_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y") 
| eval total_duration = end_collection_timestamp - starting_collection_timestamp 
| eval duration = tostring(total_duration, "duration")

[clementros]

Thank you it works

[kamlesh_vaghela]

Great @clementros. Please upvote and accept this answer to close this question.