How to order IIS logs by Start Time

Follow

Rajiv Delwadia

• November 07, 2013 19:07

IIS logs record the "End Time" for a request, along with "Time Taken" in milliseconds.

Is there a way to create another field in a Sumo search that is the calculated "Start Time", as time minus time_taken?

0

• 

  Duc Ha

  • November 07, 2013 19:40

  Yes, if the End Time is already parsed as the message time, you can simply do: 

  ... | (_messagetime-time_taken) as sTime | formatDate(fromMillis(sTime),"YYYY/MM/dd HH:mm:ss") as StartTime

   

  0

  Comment actions Permalink

Please sign in to leave a comment.