How to subtract times for different events

[xvxt006]

Hi,

i have multiple events for each order and i want to subtract start and end events for each order. So i have created a filed called "action" and which gives whether it is a start or end event. So the value for "action" field would be start or end. i have converted time to numeral number but i am not sure how to get times for start and end and then subtract for each order to calculate the latency. i have used the query below. but not sure how to move forward. Any suggestions please.

| convert mktime(_time) as T1 | eval Type=if(action=start,"start","end") | stats values(T1) as Time by Type, Order | eval Latency = ("Time: start" - "Time: end") |

[somesoni2 · Accepted solution]

Try this (assuming the value of the field Type is either 'start' or 'end')

your base search | chart first(_time) over action by OMSOrder | eval latency=end-start

[xvxt006]

i got it. i have used | convert dur2sec(Latency)

[somesoni2]

The latency calculated here will be seconds already (as end and start are epoch time). You want to format the latency value to any specify format? If you want to format it as duration, your can use this in the search.

after chart command | eval latency=tostring(end-start,"duration")

[xvxt006]

One question is, i get the latency and when i use strftime i am getting the actual time but not the duration in secs or millli seconds. is there any function for that

[xvxt006]

Awesome..Simple is better

[strive]

Since start occurs first and end in the last, can you try this simple approach...
Your search... | stats max(_time) as End, min(_time) as Start by OMSOrder | eval Latency = End - Start

[strive]

_time is already in epoch format right? why do you need to convert?