How to order IIS logs by Start Time

Comments

1 comment

  • Avatar
    Duc Ha

    Yes, if the End Time is already parsed as the message time, you can simply do: 

    ... | (_messagetime-time_taken) as sTime | formatDate(fromMillis(sTime),"YYYY/MM/dd HH:mm:ss") as StartTime

     

    0
    Comment actions Permalink

Please sign in to leave a comment.