Trying to get difference between _time and _indextime in secs format

[vinay4444]

Tried using below search, but can't get result. I get null values in diff:

XXX| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")  |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S")  | eval diff= tostring(indextime - capturetime) | table indextime capturetime diff

Am I missing something?

[jplumsdaine22 · Accepted solution]

Just do the diff calculation on the actual epoch value, before your strftime evals.

XXX| eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") |  | table indextime capturetime diff

[vinay4444]

i tried that but it does not give the difference in min or secs
e.g
capturetime indextime diff
2015-12-04 07:33:44 2015-12-04 07:33:50 6

[jplumsdaine22]

The diff field is in seconds.
The _indextime and _time fields are in unix epoch time format, the number of seconds since January 1970. When you subtract one from the other the result is a value expressed in seconds

[vinay4444]

Ok got it thanks!

[jplumsdaine22]

No problem mate. If that's working for you do you mind accepting the answer?

Cheers