Difference between two times

[mbasharat]

Hi,

I have two fields in my report. Time_Created and Time_Closed. They are for time an incident ticket was created and then closed.

Their format is:

Time_Created: 12/20/19 11:30
Time_Closed: 1/1/20 16:50

I need to find the difference between both and result in an additional field e.g. Time_to_resolution.

Basically, I need to see how long it took to resolve a ticket from its creation to closure.

Thanks, in advance!!!

[vnravikumar · Accepted solution]

Hi

Check this

| makeresults 
| eval Time_Created="12/31/19 11:30",Time_Closed="1/1/20 16:50" 
| eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y %H:%M") -strptime(Time_Created,"%m/%d/%y %H:%M"),0),"duration") 
| eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs") |table Time_Created Time_Closed Time_to_resolution

[mbasharat]

Many thanks for promptness. And how about if it is just date only?

Time_Created: 12/20/19
Time_Closed: 1/1/20

To how many days it took.

[vnravikumar]

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval temp = tostring(round(strptime(Time_Closed,"%m/%d/%y") -strptime(Time_Created,"%m/%d/%y"),0),"duration") 
 | eval Time_to_resolution=replace(temp,"(\d*)\+*(\d+):(\d+):(\d+)","\1 day(s)")

[mbasharat]

This is awesome! TY!!! This triggered my curiosity for some additional chart for my use case. How about converting below to month? Either fields with or without time will work because I am using everything you have provided.

Time_Created: 12/20/19 11:30 to MonthCreated=December

Time_Closed: 1/1/20 16:50 to MonthClosed=January

Case statement or whatever is best as you suggest?

[vnravikumar]

Check this

| makeresults 
 | eval Time_Created="12/31/19",Time_Closed="1/1/20" 
 | eval MonthCreated = strftime(strptime(Time_Created,"%m/%d/%y"),"%B"), MonthClosed=strftime(strptime(Time_Closed,"%m/%d/%y"),"%B")

[mbasharat]

Awesome!!! THANK YOU!!!