I am trying to get time difference between 2 timestamps, I have one field deployment_ts with one value and list of time stamps commit_ts , i want a list containing the difference for each value in list with the other field eval commit_to_rel = (deployment_ts - commit_ts) . Bu t I am not getting any result.
here is my query
index=x application_name="yy-xx-zz" event_type="ev"
| spath path=commits{}.date output=commit_date
| eval deployment_ts = (strptime(deployment_time, "%Y-%m-%dT%H:%M:%S%z"))
| eval commit_ts = (strptime(commit_date, "%Y-%m-%dT%H:%M:%SZ"))
| eval commit_to_rel = (deployment_ts - commit_ts)
| stats list(commit_date), list(commit_ts), list(deployment_ts), list(commit_to_rel)
Can anyone please tell me how to get this done?
here is the picture of results along with the querry.
... View more