https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628799#M218425 <P>after i tried change coloumn _time, its still work. thx</P> Mon, 30 Jan 2023 08:06:04 GMT riposan 2023-01-30T08:06:04Z https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628780#M218413 <P>please help,i used _time from date log, and i using time from windowstime, but i tried substraction bot of them not result in coloumn durationday</P><P>&nbsp;</P><P>stats max(_time) as lastlogin by user |eval n=time()|eval today=strftime(n,"%m-%d-%Y %H:%M:%S.%Q")| eval durationday = lastlogin - today | table user,lastlogin,today,durationday</P><P>&nbsp;</P><P>and result this</P><P>user lastlogin today durationday</P><TABLE><TBODY><TR><TD>dsadadnk12</TD><TD>01-30-2023 11:10:27.208</TD><TD>01-30-2023 11:25:14.000</TD><TD>&nbsp;</TD></TR></TBODY></TABLE> Mon, 30 Jan 2023 04:34:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628780#M218413 riposan 2023-01-30T04:34:48Z https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628783#M218416 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/253347">@riposan</a>,</P><P>You should calculate the duration before formatting the lastlogin. Please try below;</P><LI-CODE lang="markup">| stats max(_time) as lastlogin by user | eval n=time() | eval durationday = n-lastlogin | eval today=strftime(n,"%m-%d-%Y %H:%M:%S.%Q") | eval durationday= tostring(durationday,"duration") | table user,lastlogin,today,durationday</LI-CODE> Mon, 30 Jan 2023 06:03:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628783#M218416 scelikok 2023-01-30T06:03:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628787#M218419 <P>thx for reply my question. i tried this,still no result in coloumn durationday</P> Mon, 30 Jan 2023 06:59:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628787#M218419 riposan 2023-01-30T06:59:25Z https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628799#M218425 <P>after i tried change coloumn _time, its still work. thx</P> Mon, 30 Jan 2023 08:06:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-last-login-from-multiple-date/m-p/628799#M218425 riposan 2023-01-30T08:06:04Z