Splunk: How to get specific timestamps if there are multiple in one event and change format and timeszones to compute timediff within one event?

I have such events:

something
<operation>abc</operation>
<timeSent>2022-01-22T02:55:58.002Z</timeSent>
<operation>def</operation>
<timeSent>2022-01-21T13:09:18.333Z</timeSent>

What I now want to get is the timestamp of every event and the last timestamp (i. e. the maximum timestamp of the timeSent-timestamps).

I tried this:

rex field=_raw "timeSent>(?<timeSent>[T:0-9-.]+)Z<" 
| stats max(_time) as Responsetime, min(timeSent) as Requesttime

But this only gives me the maximum timestamp of all of the observed timestamps and the minimum of all timeSent-timestamps. Moreover, I have the problem that I have on the one hand a different format for the timestamps and also different timezones. How could I solve this in order to compute the difference of Responsetime and Requesttime?

Solution 1:

Timestamps have to be converted into epoch (integer) form before they can be compared. Do that with the strptime() function.

rex field=_raw "timeSent>(?<timeSent>[T:0-9-.]+)Z<" 
| eval timeSent = strptime(timeSent, "%Y-%m-%dT%H:%M:%S.%3N%Z")
| stats max(_time) as Responsetime, min(timeSent) as Requesttime