I have AWS Cloudtrail data and want to find out how long an EC2 instance was stopped. Is it possible to subtract the EpochOT from Row 3 to Row 2 and Row 5 to Row 4 etc..       ... View more

My original time format in the search is  eventID: d7d2d438-cc61-4e74-9e9a-3fd8ae96388d    eventName: StartInstances    eventSource: ec2.amazonaws.com    eventTime: 2024-01-30T05:00:27Z    eventType: AwsApiCall I am not able to convert it using the strptime function  eval dt_year_epoc = strptime(eventTime, "%Y-%m-%dThh:mm:ssZ") eval dt_day= strftime(dt_year_epoc, "%d") Nothing comes up in dt_day       ... View more

How can i take the eventName , instanceId and eventTime in a Pivot Table from the search below : index=aws_cloudtrail sourcetype="aws:cloudtrail" (eventName="StartInstances" OR eventName="StopInstances" OR eventName="StartDBInstance" OR eventName="StopDBInstance" OR eventName="StartDBCluster" OR eventName="StopDBCluster") AND (userIdentity.type="AssumedRole" AND userIdentity.sessionContext.sessionIssuer.userName="*sched*") | spath "requestParameters.instancesSet.items{}.instanceId" | search "requestParameters.instancesSet.items{}.instanceId"="i-0486ba14134c4355b" | spath "responseElements.instancesSet.items{}.instanceId" | spath "recipientAccountId" Events : awsRegion: us-east-1    eventCategory: Management    eventID: 3a80a688-fa82-4950-b823-69ffc3283862    eventName: StartInstances    eventSource: ec2.amazonaws.com    eventTime: 2024-01-30T11:00:38Z    eventType: AwsApiCall    eventVersion: 1.09    managementEvent: true    readOnly: false    recipientAccountId: XXXXXXXXXXX    requestID: b404437a-ee56-4531-842e-1b10c01f01d3    requestParameters: { [-]      instancesSet: { [-]        items: [ [-]          { [-]            instanceId: i-0486ba14134c4355b          }        ]      }    } ... View more