How to get elapsed time? I have the following |eval tnow = now() |convert ctime(tnow) as currtime | eval el_time =(currtime-rtime) | table ServName rtime currtime el_time Thanks
What output are you getting? You may need to run a convert on rtime if you're not already, but something like this should work:
... | eval now = now() | eval tdelta = now - rtime | table ...
