How to calculate time difference?

[EvansB]

I'm looking to get a difference between both times and create a 3rd field for the results (Properties.actionedDate - _time). My current query is like this

index=* source=* | table Properties.actionedDate, _time

Here is a screenshot of my current result

[richgalloway · Accepted solution]

I probably should make this a macro since I give this answer a lot.  Timestamps must be in epoch (integer) format to be compared or to find their difference.  Use the strptime function for that.

index=* source=* 
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff

[EvansB]

Thanks for your response.
This should work but I'm not getting results on the diff field - (I sorted with this field)
Does that mean there are no difference between timestamps and _time?

[richgalloway]

I noticed a typo in the strptime format string in my reply, which I've corrected.  I also added a rename command in case eval doesn't like the original field name.

[EvansB]

did you edit your first comment.... I'm getting same results 
can you post the corrected query? 
Appreciate.

[richgalloway]

I don't know what happened to my original edit, but I've re-posted it.

[EvansB]

I eventually used this

index=* source=*
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(actionedDate, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS 
| table actionedDate, _time, diff

Appreciate you @richgalloway