Compare usual time to Epoch time

[luckyman80]

Hi Experts! ,

                      Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is 

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

[somesoni2]

Try this

Your base search| eva diff=_time-time | table diff

[luckyman80]

Spoiler

i did try that .. now I get 
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

[somesoni2]

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

[ITWhisperer]

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)

[luckyman80]

Hi! Thanks for the quick response!  I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions 

[ITWhisperer]

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

[luckyman80]

Apols if im being stupid . I tried 

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything 

[ITWhisperer]

What do you get if you just do 

<<your search>>
| table _time epoch

[luckyman80]

_time looks like this 

2021-10-07 08:28:04.211

epoch column  is blank 

[ITWhisperer · Accepted solution]

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

[luckyman80]

thank you ! worked great