• Avatar
    Oriol Molto

    Hi Marcel,
    That really helps. There were 2 typos in your code but I could fix it. Final code that works is:
    | max(_messageTime) as lastmessagetimemillis
    | toLong(lastmessagetimemillis) as lastmessagetimemillis
    | formatDate(fromMillis(lastmessagetimemillis), "MM-dd-yy HH:mm:ss") as lastmessagetime
    | toLong(toMillis(now())) as currenttimemillis
    | formatDate(fromMillis(currenttimemillis), "MM-dd-yy HH:mm:ss") as currenttime
    | (currenttimemillis - lastmessagetimemillis) as deltamillis
    | deltamillis / 1000 as delta_seconds
    | fields delta_seconds

    Comment actions Permalink
  • Avatar
    Marcel Engler

    Hi Oriol,

    After you query for the messages that contain the keyword, use the code below to calculate the length of time. Then, publish the result to a dashboard and display using the Single Value Viewer option.

    | max(_messagetime) as last_message_time_millis
    | toLong(last_message_time_millis) as last_message_time_millis
    | formatDate(fromMillis(last_message_time_millis), "MM-dd-yy HH:mm:ss") as last_message_time
    | toLong(toMillis(now())) as current_time_millis
    | formatDate(fromMillis(current_time_millis), "MM-dd-yy HH:mm:ss") as current_time
    | (current_time_millis - last_message_time_millis) as delta_millis
    | delta_millis / 1000 as delta_seconds
    | fields delta_seconds

    Hope this helps.

    Comment actions Permalink

Please sign in to leave a comment.