How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

[jclemons7]

Hello,

I have a timestamp formatted as 2015-10-14T10:04:47.962Z and I'd like to add or subtract a fixed number of minutes from it. I've tried things similar to timestamp-5m and stuff that I'm too embarrassed to put here, to no avail. Your help is GREATLY appreciated.

[richgalloway · Accepted solution]

There are two ways to do that (perhaps others will have more), but both require the timestamp be converted to epoch time first.

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=ts-300 | ...

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=relative_time(ts, -5m) | ...

[gabrell]

Hi, how can I convert this format of Time?

start time: 2015-12-13T23:55:02+00:00
end time : 2015-12-15T23:55:02+00:00

And then I need to get the time taken from start to end TMA = (Start time - End Time) | table TMA

Can you help me out?

Thanks.

[richgalloway]

Please post a new question.

[jclemons7]

Your answer worked, but it dawned on me that I already had the value in epoch.. so I just did this

| eval ts=(_time - (5 * 60))  | .....