Not able to extract the difference. Query:
(index="events_prod_gmh_gateway_esa") SPNLDSCR* | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM
|eval Time_in = ...
See more...
Not able to extract the difference. Query:
(index="events_prod_gmh_gateway_esa") SPNLDSCR* | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM
|eval Time_in = "20" + substr(sRefInt , 9 , 15)
|eval Processing_Start_Time = strptime(HdtIn,"%Y%m%d%H%M%S.%q") , Processing_End_Time = strptime(HdtOut,"%Y%m%d%H%M%S.%q") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q")
|eval Processing_Start_Time_1 = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") ,
Processing_End_Time_1 = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") ,
Reception_Time_1 = strptime(Time_in,"%Y%m%d%H%M%S.%q"),
diff = Processing_End_Time_1 - Reception_Time_1
|convert ctime(Processing_Start_Time) , ctime(Processing_End_Time) , ctime(Reception_Time)
| table _time , ID_FAMILLE , MSG_TYP_CONV , MSG_TYP_ORIG , sRefInt , Reception_Time , Processing_Start_Time , Processing_End_Time , Processing_Start_Time_1 , Processing_End_Time_1 , Reception_Time_1 , diff