Hello All,
I have a question about how to calculate the time elapsed between the log file timestamp and the current system time. I have a log file in the format shown below and the StartTime is the time in which a software license was checked out.
BXW01 McWhorter-B01 McWhorter-B01 (v1.000) (CDCLM1/27001 2701), start Fri 6/1 10:52
JMR01 ROSETTI-J01 ROSETTI-J01 (v1.000) (CDCLM1/27001 1301), start Fri 6/1 10:52
JRS01 Sikes-JR01 Sikes-JR01 (v1.000) (CDCLM1/27001 3404), start Fri 6/1 10:56
SAE01 Prech-m204 Prech-m204 (v1.000) (CDCLM1/27001 4409), start Fri 6/1 16:22
TLB03 BAUGH-TIM-01 BAUGH-TIM-01 (v1.000) (CDCLM1/27001 3801), start Fri 6/1 11:04
TXC05 Chea-Tony Chea-Tony (v1.000) (CDCLM1/27001 2608), start Fri 6/1 16:34
axb03 BALDWIN-A01 BALDWIN-A01 (v1.000) (CDCLM1/27001 5303), start Fri 6/1 16:34
bws02 40SMITH-BRIANW 40SMITH-BRIANW (v1.000) (CDCLM1/27001 5201), start Fri 6/1 11:32
cgv01 VIER-C01 VIER-C01 (v1.000) (CDCLM1/27001 1402), start Fri 6/1 16:02
cocotp COCOTP023 COCOTP023 (v1.000) (CDCLM1/27001 5710), start Fri 6/1 12:19
I would like to know how long each user has used a particular license. Therefore, I would like to have LP return the below format but also ADD a column for the calculated time elapsed between the StartTime and the System Time in xx(days) xx(hours) xx(min). I can get the results shown below. Now I am working to calculate and output the elapsed time only and am stuck.
User Machinename Version StartTime
BXW01 McWhorter-B01 (v1.000) 6/5 10:52
JMR01 ROSETTI-J01 (v1.000) 6/5 10:52
JRS01 Sikes-JR01 (v1.000) 6/5 10:56
SAE01 Prech-m204 (v1.000) 6/5 16:22
TLB03 BAUGH-TIM-01 (v1.000) 6/5 11:04
TXC05 Chea-Tony (v1.000) 6/5 16:34
axb03 BALDWIN-A01 (v1.000) 6/5 16:34
bws02 40SMITH-BRIANW (v1.000) 6/5 11:32
cgv01 VIER-C01 (v1.000) 6/5 16:02
cocotp COCOTP023 (v1.000) 6/5 12:19
I have tried the command:
LogParser -i:TSV -iSeparator:space -iTsFormat:"M/d h:mm" "SELECT SUB(TIMESTAMP('StartTime', 'M/d h:mm'), SYSTEM_TIMESTAMP()) INTO users.tmp FROM users.log"
and I get in return Error: Syntax Error: (value): Invalid month in timestamp "StartTime"
After scouring the KB and Forums I haven't found anything like what I'm trying to do. Do I need to convert the Timestamp to an Integer then calculate the difference?
Any help is much appreciated.