# Subtract timestamps from logs basis a field and show as a view on dashboard
**URL:** https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718
**Category:** Kibana
**Created:** [October 29, 2022, 8:06am UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718 "2022-10-29T08:06:50Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)
#### Post date: [October 29, 2022, 8:06am UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/1 "2022-10-29T08:06:50Z")
Apologies for reposting this. As a newbie to Kiabana, I couldn't achieve the earlier proposed solution from Kibana views. Can someone please guide me how and where to add equation or add code to achieve below? Any snippet would really help.
My logs are having below 2 entries:
@timestamp:Sep 10, 2022 @ 20:11:42.677 fingerprint:2222-605819443b6 Item\_Name:069931601477 jobId:4444-ff-4555 level:Info levelOrdinal:2 logF\_BusinessProcessName:Test logType:User machineId:111 machineName:hostname1 message:test | ProcessCode : 10000 rawMessage:{"message":"test| ProcessCode : 10000","level":"Information","logType":"User","timeStamp":"2022-09-10T20:11:42.6778335+05:30"
@timestamp:Sep 10, 2022 @ 20:11:46.531 fingerprint:2322-44444444 Item\_Name:069931601477 jobId:4444-ff-4555 level:Info levelOrdinal:2 logF\_BusinessProcessName:Test logType:User machineId:111 machineName:hostname1 message:test | ProcessCode : 10000 rawMessage:{"message":"test| ProcessCode : 10000","level":"Information","logType":"User","timeStamp":"2022-09-10T20:11:46.531895+05:30"
I need to subtract timestamps of above 2 entries based on the 'ProcessCode' field in seconds. And create view for it.
Please suggest. TIA.
Regards.
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [November 3, 2022, 4:38pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/2 "2022-11-03T16:38:30Z")
It should work with a "Difference" function in the Lens visualization and a Group by "processCode".
---
### Author:  [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)
#### Post date: [November 6, 2022, 5:23pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/4 "2022-11-06T17:23:34Z")
@Marius_Dragomir Thanks for your response. Can you please provide me more details on where and what exactly I should do with my aboven2 log entries?
I tried few things but couldn't solve it with my limited knowledge at this moment.
Thanks.
---
### Author:  [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)
#### Post date: [November 7, 2022, 6:58am UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/5 "2022-11-07T06:58:22Z")
Hi Marius,
May I know what is processcode, is it something that gets logged by default?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2022, 7:23pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/6 "2022-12-04T19:23:13Z")
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2023, 11:08am UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/7 "2023-01-01T11:08:31Z")
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 29, 2023, 11:09am UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/317718/8 "2023-01-29T11:09:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.