Difference between Start and End Time

[twh1]

I have a event, where starttime and endtime are coming as string. I am using below query.

.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | eval  Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration

With help of this query, I am able to get the right value for Start and End time, but duration is coming 00:00 as both time are in different format. I Tried to convert both time in same format using convert function but getting blank value.

.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | convert ctime(Start_Time) | convert ctime(End_Time) | eval  Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration

Can anyone help me to get the difference of Start and End time.

Thanks in advance.

[HiroshiSatoh]

Please convert End_Time to epoch time and calculate Duration.
eval End_Time=strptime(End_Time,"your format")

＞ | convert ctime(Start_Time) | convert ctime(End_Time)
ctime needs an epoch time. Strings can not be used.

＞ |eval Start_Time=strftime(_time, "%H:%M;%S")
Start_Time：String
_time：epoch time

If duration is 00:00, check the _time of the transaction start and end logs.

[twh1]

I tried to convert format for End_Time but getting blank value for that field. I used below query now.

... "Start time for " |eval Start_Time=strftime(_time, "%H:%M:%S") |sort -Start_Time   | table  Start_Time | appendcols [ search ..... "End time for " |eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strftime(End_Time, "%H:%M:%S") | eval Duration= End_Time
-Start_Time |sort -End_Time | table  End_Time ]  | table Start_Time End_Time Duration

[HiroshiSatoh]

Please show me sample log.

|eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strftime(End_Time, "%H:%M:%S")
|eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strptime(End_Time, "%H:%M:%S")
However, because it is 9 digits, the format is different
"%H:%M:%S"->00:00:00 (8 digits)