I am trying to find a way to produce a column in a table to show the difference between the recieved_time and the remediation_time. Currently the Diff_in_Time field and TotalDiff_in_Time fields return empty. Any
index=someapplication sourcetype=some_log subject="*" "folder_locations{}"="*" from_address="*" remediation_timestamp="*" received_time="*" recipient_address="*" to_addresses="*"
| eval rectime=received_time
| eval remtime=remediation_timestamp
| eval Diff_in_Time=strptime(rectime, "%Y-%m-%d %H:%M:%S.%3N")-strptime(remtime, "%Y-%m-%d %H:%M:%S.%3N")
| eventstats sum(Diff_in_Time) as TotalDiff_in_Time
| table rectime remtime Diff_in_Time TotalDiff_in_Time
... View more