How to subtract two time fields?

[cotyp]

How would I go about subtracting EndTime from BeginTime?

[adonio]

hello there,
try this:

... your search ...
|eval end_time_epoch = strptime(EndTime, "%m/%d/%Y %H:%M:%S")
|eval begin_time_epoch = strptime(BeginTime, "%m/%d/%Y %H:%M:%S")
| eval duration = end_time_epoch - begin_time_epoch

hope it helps

[cotyp]

How would I make the epoch time human readable? Results to display in a manner such as, 8d 15 hrs 20 minutes?

[adonio]

try this at the end of your query:

  | eval "duration_Days+HHMMSS" = tostring(duration, "duration")

[493669 · Accepted solution]

Try this run anywhere search:

|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")|eval days=round((EndTime-BeginTime)/86400)

[cotyp]

how would you go about getting results in minutes?

[493669]

to get results in min divide the difference(in sec.) by 60

...|eval minutes=round((EndTime-BeginTime)/60)

[493669]

if you want duration in day hr and min then try this run anywhere search:

|makeresults|eval EndTime="2/14/2018 9:28:19", BeginTime="2/6/2018 14:53:45"|eval EndTime=strptime(EndTime,"%m/%d/%Y %H:%M:%S"), BeginTime=strptime(BeginTime,"%m/%d/%Y %H:%M:%S")| eval stringSecs = tostring((EndTime-BeginTime), "duration")| eval stringSecss = replace(stringSecs,"(\d+)\+(\d+)\:(\d+)\:.*","\1d \2h \3min ")

[cotyp]

thank you!

[493669]

Glad to help you:) Please accept the answer as well.