How to edit my search to calculate the difference between two timestamps in the same event?

[pkurt]

Hello,

I am trying to determine the time difference between the two timeStamp columns in my events.
I tried to use the search below, but cannot return anything for the "diff" at the end...

 ... my base search ... | eval raw_time=strptime(_time,'%Y-%m-%dT%H:%M:%S')  | eval utc_endtime=strptime(UTC_EndTime,'%Y-%m-%dT%H:%M:%S') | eval diff= raw_time-utc_endtime

My example events are like this:

2016-10-15T03:59:59.999999, UTC_EndTime=2016-10-14T19:59:59.999999,
2016-10-15T02:59:59.999999, UTC_EndTime=2016-10-14T18:59:59.999999,
2016-10-15T01:59:59.999999, UTC_EndTime=2016-10-14T17:59:59.999999,

I would appreciate if you can help me to see the mistake I am doing here.

Many thanks!

[somesoni2 · Accepted solution]

The _time is already in epoch time (just shows as human readable form in search result/table), so no need to convert it. Updated the timeformat as well for UTC_EndTime.

  ... my base search ...   | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S.%N") | eval diff= _time-utc_endtime

[pkurt]

it worked, thank you very much!

[cmerriman]

Use convert.

  ... my base search ... | Convert mktime(_time) as raw_time timestamp="%Y-%m-%dT%H:%M:%S" | Convert mktime(UTC_EndTime) as utc_endtime "%Y-%m-%dT%H:%M:%S"| eval diff= raw_time-utc_endtime

[pkurt]

I could not make this work. Thank you very much though!

[sundareshr]

Change single quotes ' to double quotes "

| eval raw_time=strptime(_time,"%Y-%m-%dT%H:%M:%S")  | eval utc_endtime=strptime(UTC_EndTime,"%Y-%m-%dT%H:%M:%S") | eval diff= raw_time-utc_endtime

[pkurt]

Thank you very much. Double quotes are not the issue. It works only if I add ".%N" to my time string since the actual timeStamp has ".999999" component.