I am trying to write a search for figuring out whether a user has logged in within the last 90 days. At the end of the process, I want to show some visualization showing the number of users that have logged in in the last 90 days and the number of users that haven't logged in in the last 90 days.
The log file is a PowerShell generated CSV file (doing a get-aduser with various selects). One of those variables is "LastLogonDate". The CSV inputs this as "19-Feb-18 2:28:46 PM" for example. I have extracted from this the date so have an extracted field called "DateLastLogon" that shows as "19-Feb-18".
My calculation is meant to look at this extracted field and compare it to the current time (timenow) and do a count of the number of users where DateLastLogon is greater than 90 days and a second search where the DateLastLogon is less than 90 days.
I suggest you try re-running your searches and making them either the last 24 hours, or perhaps even All Time. Are you certain that there is data in the "myindex" that you are searching, for the right time period? Remove the line "| table timediff", what fields are being calculated (lastlogontime, timenow, timediff).