I have two timestamps that are in this format within my log events:
start: 2005-07-05T04:28:34.453494Z
end: 2005-07-05T05:28:39.462681Z
I would like to subtract the timestamps then evaluate them to see if the result is greater or equal to 1 hour and include that event in my query results
Extra:
if so how long?
| rex "start: (?<start>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)"
| rex "end: (?<end>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)"
| eval start=strptime(start,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval end=strptime(end,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval diff=end-start
| where diff>=(60*60)
| fieldformat diff=tostring(diff,"duration")
| rex "start: (?<start>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)"
| rex "end: (?<end>\d{4}\-\d\d\-\d\dT\d\d:\d\d:\d\d\.\d+Z)"
| eval start=strptime(start,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval end=strptime(end,"%Y-%m-%dT%H:%M:%S.%6QZ")
| eval diff=end-start
| where diff>=(60*60)
| fieldformat diff=tostring(diff,"duration")
This works great! If you have time can you explain it a bit, I don't know why we need to use "rex" to extract the time? I get the rest of the query as that was one of my initial tries but without the rex. Thanks!