How to create a beautified time difference?

[danielbb]

We have the following code:

| stats count min(_time) as min, max(_time) as max by src, ....
| eval delta = (max - min)/(60*60*24)

How can we present this delta field as, let's say - 3 days, 2 hours, 16 minutes ?... or any other human readable way.

[rslama]

this answer is wrong. you are trying to strftime from milliseconds. although the result will show readable format, the values are invalid.

[ololdach]

Hi danielbb, try: | makeresults | eval mintime=1570466331.984 | eval maxtime=32890568331.784 | eval stime= round(maxtime-mintime,0) | eval timestr=strftime(stime,"%j days, %H hours, %M minutes, %S seconds")