I'm looking to get a difference between both times and create a 3rd field for the results (Properties.actionedDate - _time). My current query is like this
index=* source=* | table Properties.actionedDate, _time
Here is a screenshot of my current result
I probably should make this a macro since I give this answer a lot. Timestamps must be in epoch (integer) format to be compared or to find their difference. Use the strptime function for that.
index=* source=*
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff
I probably should make this a macro since I give this answer a lot. Timestamps must be in epoch (integer) format to be compared or to find their difference. Use the strptime function for that.
index=* source=*
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff
Thanks for your response.
This should work but I'm not getting results on the diff field - (I sorted with this field)
Does that mean there are no difference between timestamps and _time?
I noticed a typo in the strptime format string in my reply, which I've corrected. I also added a rename command in case eval doesn't like the original field name.
did you edit your first comment.... I'm getting same results
can you post the corrected query?
Appreciate.
I don't know what happened to my original edit, but I've re-posted it.
I eventually used this
index=* source=*
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(actionedDate, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff
Appreciate you @richgalloway