I want to find time difference between two events (duration some operation took) and plot a graph which shows how much time it took for each of the entity ... I gave some query mentioned below :
<base_search>|
| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours))) | fieldformat duration = tostring(duration, "duration") | fieldformat duration_in_minutes = duration / 60
Now i got correct output in the form of a table , but with some extra fields I need first column (cls_id) and last column (duration_in_minutes) , Can someone help how can i get that?
I tried appending | table cls_id , duration_in_minutes , but that gives null value for "duration_in_minutes" field/column.
... View more
