How to calculate the time difference in minutes between two events?

[msachdeva3]

I have two events

I'm using this

nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time|

start date or vendor notified time looks like this : 2016-10-21 18:59:00
I want to see results difference in minutes??

[somesoni2]

Assuming you're not getting your latency field populated here, are both VENDOR_NOTIFIED_TIME and START_DATE field appear in separate events? If yes, then you would need to join those two events using some common field.

[cmerriman · Accepted solution]

turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.

|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time

[msachdeva3]

convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y/%m/%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y/%m/%d %H:%M:%S"|

tried displaying results with table command
|table nt_time st_time |head 5

these fields are empty i.e not working
unable to convert time i guess

[cmerriman]

what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?

I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.