Hello, Looking for some help with my search.
The convert works fine for Last and First Occurrence but not sure why not for the two eval commands? The two eval commands bring me back seconds I think? example 17778.566205 or is that EPOC? I need to convert them to days/hours/mins and I've tried several things but not having any luck.
index=ABC MessageText="Kickout"
|stats max(_time) as LastOccurence min(_time) as FirstOccurence by MessageText
|eval "Duration Between Events"=LastOccurance-FirstOccurence
|eval "Time Since Last Event"=(now()-LastOccurence)
|convert timeformat="%m/%d/%Y %H:%M:%S" ctime("FirstOccurence")
|convert timeformat="%m/%d/%Y %H:%M:%S" ctime("LastOccurence")
|table FirstOccurence, LastOccurence, "Duration Between Events", "Time Since Last Event"
... View more
