How to subtract two specific requestTime

[Alan_Bradley]

For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T08:43:15" when pageSubmitted="/snapcCustomer.xhtml" from requestTime="2009-05-26T08:47:23" when pageSubmitted="/snapcPremium.xhtml" 08:47:23 - 08:43:15 = 4:12 (4 minutes and 12 seconds) This the value I want to compute. How can I achieve this?

[matt · Accepted solution]

convert dur2sec works well for this one:

<search_terms> | convert dur2sec(requestTime) as reqTimeConverted | convert dur2sec(responseTime) as respTimeConverted | eval duration=respTimeConverted-reqTimeConverted