Issue with Time Conversion in JSON String

[leftrightleft]

Hey 👋,

I'm trying to get the time difference between when an event was received and a string representation of the time in the event.  

Here's an example of the event:

{
    "action": "created",
    "alert": {
        "number": 818,
        "created_at": "2021-11-16T21:52:12Z",
        "url": "https://somewebsite.com"
    }
}

The issue is the conversion of the time in "alert.created_at" from string to epoch.  Once I'm able to get the epoch representation, calculating the difference from _time is easy.  

I'm working off this eval statement, but cant get it to work:

 | eval strtime=strptime(alert.created_at, "%Y-%m-%dT%H:%M:%SZ") | table strtime

Any thoughts?  Thanks!

[kamlesh_vaghela · Accepted solution]

@leftrightleft 

Can you please try this?

| eval strtime=strptime('alert.created_at', "%Y-%m-%dT%H:%M:%SZ")

My Sample Search :

| makeresults 
| eval _raw="{\"action\": \"created\",\"alert\": {\"number\": 818,\"created_at\": \"2021-11-16T21:52:12Z\",\"url\": \"https://somewebsite.com\"}}" 
| spath 
| eval strtime=strptime('alert.created_at', "%Y-%m-%dT%H:%M:%SZ")

 KV

[leftrightleft]

@kamlesh_vaghela, I wish I could give you more than just a thumbs up.  At a minimum, you deserve a high five.  Honestly, I would probably even give you a hug if I could 😄

Seriously though, thanks a lot.  I really was struggling with this.  I didn't realize the single quotes were what was needed.  I actually tried double quotes around the field name at one point, but it interpreted it as literally "alert.created_at".