I have two events
I'm using this
nt_time=strptime(VENDOR_NOTIFIED_TIME,"%F %T")|eval st_time = strptime(START_DATE,"%F %T") |eval latency = nt_time-st_time|
start date or vendor notified time looks like this : 2016-10-21 18:59:00
I want to see results difference in minutes??
turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.
|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time
Assuming you're not getting your latency field populated here, are both VENDOR_NOTIFIED_TIME and START_DATE field appear in separate events? If yes, then you would need to join those two events using some common field.
turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.
|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time
convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y/%m/%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y/%m/%d %H:%M:%S"|
tried displaying results with table command
|table nt_time st_time |head 5
these fields are empty i.e not working
unable to convert time i guess
what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?
I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.