|eval start=strptime("2017-02-03 09:51:54.595","%Y-%m-%d %H:%M:%S.%3N")
|eval end=strptime("2017-02-03 09:46:21,892","%Y-%m-%d %H:%M:%S,%3N")
IF those are already being shown as fields
EndTime, then this should work. NOTE is EndTime really differently formatted with a comma and not a period? Not really a problem, just double-check things.
base search ... | eval ConvertedStart=strptime(StartTime, "%Y-%m-%d %H:%M:%S.%3Q") | eval ConvertedEnd=strptime(EndTime,"%Y-%m-%d %H:%M:%S,%3Q") | eval ElapsedTime=ConvertedEnd-ConvertedStart
You may or may not need the eval for Elapsed time, it depends if it is properly seen as a time or as a string. Although, the idea is likely necessary because to do math on these, you'll want to convert them to unix Epoch times, which is what we do. So they're seconds past Jan 1, 1970. You'll have to convert them back to display them better (strftime and others, also able to be found from those above links).
Try like this for difference between starttime (assuming field name is StartTime) and _time (Splunk extracted event timestamp)
your base search | eval Difference=_time -strptime(StartTime, "%Y-%m-%d %H:%M:%S.%3Q") | Diff_DurationFormat=tostring(Difference,"duration")
@sravankaripe: Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thank you.