Hi,
I have two fields, where time zone seems to be different.. please could you help me to get difference ?
itime= 2024-02-22 20:56:02,185
stime=2024-02-23T01:56:02Z
I tried the below but it always gives around 5 hrs delay..
SPL:
| eval itime=strptime(Initial_Time,"%Y-%m-%d %H:%M:%S,%3N")
| eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S")
| eval difference = abs(itime - stime)
| eval time_difference=tostring(difference, "duration")
Have you tried incorporating the time zone in the strptime call?
| eval stime=strptime(s_time,"%Y-%m-%dT%H:%M:%S%Z")