How to subtract dates from two iso 8601 date fields in order to find the duration?

[aahmad]

Hey, I am working on making a dashboard and wanted to know how can I subtract two dates that are in iso 8601 format. 

Please refer to the snippet of json below:

{ "startTime": "2022-04-25T01:02:19.221Z", "endTime": "2022-04-25T01:57:59.417Z"}

[richgalloway]

Dates must be converted into epoch (integer) form before they can be subtracted.  Use the strptime function to do that.

| eval st=strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3N%Z"), et=strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3N%Z")
| eval diff = et - st

[aahmad]

@richgalloway  I tried your solution. My only problem is that when I do "table diff" in the end. I see empty fields. Do you know how can I fix that?

[richgalloway]

A null diff field means the et and/or st fields were null, which probably means the startTime/endTime fields were never extracted.  There are several ways to extract the fields, but I like to use rex.

{ "startTime": "2022-04-25T01:02:19.221Z", "endTime": "2022-04-25T01:57:59.417Z"}

| rex "startTime\\\":\\\"(?<startTime>[^\\\"]+)\\\",\\\"endTime\\\":\\\"(?<endTime>[^\\\"]+))"
| eval st=strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3N%Z"), et=strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3N%Z")
| eval diff = et - st