Hi abdulbadii,
When I try your code with your sample input, your first suggestion produces the output:

Code:

awk: unknown option -N ignored

15:23:45,255 WARN <NTS>  RouteRequest : 518318 ### 15:23:45,258 CRIT <ISUP> RouteResponse : 518318 || -15000

and your second suggestion produces the output:

Code:

15:23:45,255 WARN <NTS>  RouteRequest : 518318 ### 15:23:45,258 CRIT <ISUP> RouteResponse : 518318 || -15000

which is exactly what I would expect when subtracting a string starting with 15: from the string WARN and multiplying the result by 1000.

If you had used $8 and $1 (instead of $2 and $1) with an awk that conforms to the standards, your results would have been 1000 times the difference between the hours portions of the two timestamps. What system are you using where the above code produces the output requested by the person who started this thread?