calculate hours difference between times

[Dassari]

I want to calculate the hours difference between two times, I am using the below search command but its not working, please help to correct my search command

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval diff = endTime - startTime

[richgalloway]

Timestamps can only be compared in epoch form. Try this.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | convert mktime(*Time) timeformat="%y/%m/%d %H:%M:%S" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch

[jplumsdaine22]

Doesn't convert mktime create epoch fields?

[DalJeanis]

Yes, that third pipe turns any field that ends with "Time" (*Time) into an epoch time field.

[richgalloway]

You're right. Correcting the time format in the convert command should be enough. If it still doesn't work then this alternative should.

| stats count | eval startTime = "2016-12-15T04:12:07Z" | eval endTime = "2016-12-15T05:13:07Z" | eval startEpoch=strptime(startTime,"%Y/%m/%d %H:%M:%S%Z"), endEpoch=strptime(endTime,"%Y/%m/%d %H:%M:%S%Z") | eval diff = endEpoch- startEpoch

[jplumsdaine22]

Your timeformat parameter does not match your time format. Try timeformat="%Y-%m-%dT%H:%M:%SZ"