![]() You might need to adjust the time format for time difference in the second one. I went over the solutions on splunk and Stack Overflow, but still cant get the proper result. Now I want to calculate duration of these two events for every request. This gives the following transaction events: | transaction ConcessionAreaCode OperationDate LinePlanningNumber TripNumber with mvlist=t | Eval rijtijdarr=strptime(RecordedArrivalTime, "%H:%M:%S"), rijtijddep=strptime(RecordedDepartureTime, "%H:%M:%S") index="ndov" ConcessionAreaCode=GVB LinePlanningNumber=2 RecordedArrivalTime!=00:00:00 RecordedDepartureTime!=00:00:00 I am using the following search to create the transaction. The data is structured in a way that its pretty easy to get a transaction per trip, but I am battling to now get the ride times between the sub events. I am have data about bus routes with arrival times at stops and I am trying to find the ride time between the stops.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |