I need to calculate the duration of time between events however my source does not adjust for timezones.
In my example a calculating the duration of when a helpdesk log was created and acknowledged is generating negative numbers for persons that live outside the timezone where the database entry was added.
Is there a way to dynamically add +1 hour to results that generate a negative number?
Assuming the result is in seconds,
eval result = if(result<0, result+3600, result)
Thank you!