I have some search results that return values in the format %Y-%m-%d %H:%M:%S. For example:
...some search... | table UpdateTime
This would yield the following table:
2018-06-06 13:49:28
2017-12-22 08:23:21
I know for a fact that time string is in UTC, not my local time. All I need to do is display the number of minutes that have elapsed between that UTC string and the time the event was recorded (_time). Everything I try keeps giving me negative numbers for recent events, I assume because it is treating the UpdateTime field as being in local time, not UTC.
Can anyone help me?
Figured it out. Update Time needed a timezone identifier:
eval UpdateTime = UpdateTime." UTC"
Then I can convert the value properly:
eval EpochTime = strptime(UpdateTime, "%Y-%m-%d %H:%M:%S %Z")
eval ElapsedMinutes = (_time - UpdateTime) / 60
Figured it out. Update Time needed a timezone identifier:
eval UpdateTime = UpdateTime." UTC"
Then I can convert the value properly:
eval EpochTime = strptime(UpdateTime, "%Y-%m-%d %H:%M:%S %Z")
eval ElapsedMinutes = (_time - UpdateTime) / 60