subtracting 2 timestamps and then evaluating if that result is longer than 1 hour

[samnew4598]

I have two timestamps that are in this format within my log events:

start: 2005-07-05T04:28:34.453494Z

end: 2005-07-05T05:28:39.462681Z

I would like to subtract the timestamps then evaluate them to see if the result is greater or equal to 1 hour and include that event in my query results

Extra:

if so how long?

[ITWhisperer · Accepted solution]

| rex "start: (?<start>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)"
| rex "end: (?<end>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)"
| eval start=strptime(start,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval end=strptime(end,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval diff=end-start
| where diff>=(60*60)
| fieldformat diff=tostring(diff,"duration")

[samnew4598]

This works great! If you have time can you explain it a bit, I don't know why we need to use "rex" to extract the time? I get the rest of the query as that was one of my initial tries but without the rex. Thanks!