Find the diff between two times

[luckyman80]

Hi I am really struggling to find the difference between the 51= time and the 59= time below and add to a separate column

My log extract example is 

2021-01-06 12:37:57.411 [FIDO1] INFO LogAuditor - [FIDO2] Outgoing [12294][0] : 8=FIX.4.4
9=541
35=D
49=FIDO1
56=FIDO2_192_168_0_1
34=15992
51=20210106-17:37:57.410
11=1609686062170-FIDO15140WTZ000878
15=USD
21=1
38=1000000
40=2
44=19.6321
54=2
55=PECEOF
59=3
59=20210106-17:37:57.409

Thanks in advance experts 

[luckyman80]

i actually noticed there is an issue with the strp time as there is no results given when i table the diff and epoch51/epoch59 items 

[richgalloway · Accepted solution]

Sorry about that.   There were some typos in my answer.  I've fixed them.

[richgalloway]

First, we need to extract the fields.  Then we convert the timestamps into epoch form.  Finally, we can compute the difference.

<your search>
| rex "51=(?<ts51>\d{8}-\d\d:\d\d:\d\d\.\d{3})"
| rex "59=(?<ts59>\d{8}-\d\d:\d\d:\d\d\.\d{3})"
| eval epoch51=strptime(ts51,"%Y%m%d-%H:%M:%S.%3N"), epoch59=strptime(ts59,"%Y%m%d-%H:%M:%S.%3N")
| eval diff=epoch59 - epoch51

[luckyman80]

hi thanks for this. I still am unable to see the def in a separate column. Whats the best way of displaying the results for the diff ? in a table ?