Parse time by combining logs

Comments

1 comment

  • Avatar
    Azriel Nguyen

    Try this Sachin,

    | toMillis(parseDate(enter_time, "HH:mm:ss.SSS")) as enterMillis
    | toMillis(parseDate(exit_time, "HH:mm:ss.SSS")) as exitMillis
    | exitMillis - enterMillis as diffMillis
    | diffMillis * .001 as diffSeconds
    | diffSeconds / 60 as diffMinutes
    | where diffMinutes > 5

Please sign in to leave a comment.