Subtract two timestamps in one event

[jscottmiller]

Hopefully this is a simple question, but I haven't found a way to do so using either the convert or eval commands. Basically, I have two timestamps in my events, a start time and an end time. I want to compute a duration (preferably in seconds) by subtracting the two. Is there a simple way to do this?

[JohnB]

Add something like this:

| eval TotalTime = strptime(end_time, "%Y-%m-%dT%H:%M:%S%z") - strptime(start_time, "%Y-%m-%dT%H:%M:%S%z")

(Assuming your date format is in that type of time stamp).

[gkanapathy]

You can use either convert mktime() or the eval strptime() functions to convert both timestamps to epoch time, then just subtract one from the other.