https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/562731#M196079 <LI-CODE lang="markup">| stats latest(_time) as lastreport by server | where now()-lastreport &gt; 12*60*60</LI-CODE> Tue, 10 Aug 2021 12:05:09 GMT ITWhisperer 2021-08-10T12:05:09Z https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/562722#M196075 <P>I have two results of servers list as per last 30 days and last 12 hrs. I want to compare and find out which servers are not reporting in 12 hrs list. What can be the query for it.<BR />Little new in Splunk.</P> Tue, 10 Aug 2021 10:55:26 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/562722#M196075 Sirius27 2021-08-10T10:55:26Z https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/562731#M196079 <LI-CODE lang="markup">| stats latest(_time) as lastreport by server | where now()-lastreport &gt; 12*60*60</LI-CODE> Tue, 10 Aug 2021 12:05:09 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/562731#M196079 ITWhisperer 2021-08-10T12:05:09Z https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/563146#M196211 <P>Hi,<BR />That worked wonderfully, but I'm not getting what type of output is coming lastreport as&nbsp; some 10 numbers of digit is coming in it.</P> Fri, 13 Aug 2021 06:37:48 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/563146#M196211 Sirius_27 2021-08-13T06:37:48Z https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/563147#M196212 <P>lastreport will be an epoch time i.e. the number of seconds since the beginning of 1970. Use strftime to format how it is displayed</P><LI-CODE lang="markup">| fieldformat lastreport=strftime(lastreport,"%Y/%m/%d %H:%M:%S")</LI-CODE><P>&nbsp;</P> Fri, 13 Aug 2021 06:42:23 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Time-difference-search/m-p/563147#M196212 ITWhisperer 2021-08-13T06:42:23Z