Show the time range of a search in HH:MM in a table

[chadman]

I would like to show the HH:MM of my search as a field in a table. How can I set that up as a field?

[sundareshr · Accepted solution]

Like this

your base search | eval time=strftime(_time, "%H:%M") | table _time time 

*UPDATED based on comment*

your base search | addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | table dur*

[chadman]

Perfect! That worked great!

[chadman]

actually displaying this in seconds would work better.

[sundareshr]

So you want to display the duration of the search? Are you displaying it in a dashboard?

[chadman]

So if I do a search from 8AM to 9AM I would like to see the difference in seconds, 3600

[sundareshr]

Aha.. see updated answer below..