Devices or sourcetypes not sednig logs

[riqbal47010]

Its a bit complicated query but let me explain.
One device=a start sending logs after 3 months. befor 3 months there was logs and LAST LOG/EVENT RECEIVED YESTERDAY.

So i want to see earliest, latest and difference between noew() and latest event.

dvc/host latestTime earliestTime daydiff
1 07/02/2019 09:40:55 04/04/2019 00:01:13 01/02/1970 07:27:59

below is my query:

index=xxx
| stats latest(_time) as latestTime, earliest(_time) as earliestTime by dvc
| convert ctime(latestTime) as latestTime, ctime(earliestTime) as earliestTime

and when I add below:

index=xxx
| stats latest(_time) as latestTime, earliest(_time) as earliestTime by dvc
| eval daydiff = (now()-latestTime)
| convert ctime(latestTime) as latestTime, ctime(earliestTime) as earliestTime, ctime(daydiff)

the daydiff field show the result = 01/01/1970

[adonio]

try something like this if the device has the host filed. if not, convert to use stats

| tstats min(_time) as first_event max(_time) as last_event where index=* by host
| eval now_time = now() 
| eval gap_from_last_event = now_time - last_event
| eval first_human = strftime(first_event, "%c")
| eval last_human = strftime(last_event, "%c")
| eval HMS_diff = tostring(gap_from_last_event, "duration")

hope it helps