eval duration/latency

[Mohsin123]

My timestamp-in and timestamp-out fields are in this format 2018-07-23T15:53:11.588Z
how do i calculate duration ?
i am calculating latency in time i.e response code .

i tried |eval tin=substr(tostring(timestamp-in),12,23) and also strptime

Anyone can help ?

[somesoni2]

Try like this

your current search | eval latency=strptime('timestamp-out',"%Y-%m-%dT%H:%M:%S.%3N%Z")-strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%3N%Z")