Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Difference between two date by field

$
0
0
Hello,This is my query | loadjob savedsearch="myquery" |where strftime(_time, "%Y-%m-%d") = "2020-02-24" |eval show=if(STEP="show",strftime(_time, "%Y-%m-%d %H:%M:%S"),NULL),click=if(STEP="Click",strftime(_time, "%Y-%m-%d %H:%M:%S"),NULL) |stats max(show) as show ,min(click) as click by client I have two date : show and click i want to calculate the difference between the two date by client Exemple of the result : client : RYU5890 Show : 2020-02-24 10:15:00 click: 2020-02-24 10:20:00 Diff: 5 client : FH5Y411 Show : 2020-02-24 09:20:00 click: 2020-02-24 09:21:00 Diff: 1

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>