We have the following code:
| stats count min(_time) as min, max(_time) as max by src, .... | eval delta = (max - min)/(60*60*24)
How can we present this delta field as, let's say - 3 days, 2 hours, 16 minutes ?... or any other human readable way.
delta
this answer is wrong. you are trying to strftime from milliseconds. although the result will show readable format, the values are invalid.
Hi danielbb, try: | makeresults | eval mintime=1570466331.984 | eval maxtime=32890568331.784 | eval stime= round(maxtime-mintime,0) | eval timestr=strftime(stime,"%j days, %H hours, %M minutes, %S seconds")
| makeresults | eval mintime=1570466331.984 | eval maxtime=32890568331.784 | eval stime= round(maxtime-mintime,0) | eval timestr=strftime(stime,"%j days, %H hours, %M minutes, %S seconds")
