index="SOMETHING" earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time= action_EndTime - action_StartTime
| convert ctime(action_StartTime) ctime(action_EndTime) ctime(elapsed_Time)
| fields + action_StartTime action_EndTime elapsed_Time
| sort by action_StartTime
The elapsed_Time is wrong, how can i make it correct?
Hi @saurabhbdwj,
elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:
index="SOMETHING" earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime)
| table action_StartTime action_EndTime elapsed_Time
| sort by action_StartTime
Ciao.
Giuseppe
Hi @saurabhbdwj,
elapsed time is a difference between two dates in epochtime, so you cannot display it in date format, you should display it in seconds or in duration:
index="SOMETHING" earliest=-30d@d
| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime
| eval elapsed_Time=tostring(action_EndTime-action_StartTime,"duration")
| convert ctime(action_StartTime) ctime(action_EndTime)
| table action_StartTime action_EndTime elapsed_Time
| sort by action_StartTime
Ciao.
Giuseppe
Hi @gcusello
This works exactly the way i want. Thank you for you help.