Subtracting Two Dates to get a Difference in Days

[itsmevic]

Hello,

I'd like to obtain a difference between two dates.  One of these dates falls within a field in my logs called, "Opened".  I'd like to minus TODAY's date from the "Opened" field value and then display the difference in days.  The format of the date that in the Opened column is as such:

2019-12-16 13:09:30

Any insight on how to write the SPL for this is greatly appreciated.

index=dw sourcetype=dw
|stats count by Number, Contact, Discovery Method, State
|eval....

[itsmevic]

index=dw sourcetype=*
|rename opened_at as InTime
|eval "FirstAuth"= strftime((InTime ),"%d.%m.%y")
|rename _time as OutTime
|eval "LastAuth"= strftime((OutTime ),"%d.%m.%y")
|eval Lastloginduration = round((LastAuth-FirstAuth)/86400)
|table Lastloginduration

Interestingly, this query isn't pulling anything?

[to4kawa]

index=dw sourcetype=*
|eval FirstAuth= opened
|eval LastAuth= _time
|eval Lastlogin_duration = round((LastAuth-FirstAuth)/86400)
|table Lastlogin_duration

Hi, @itsmevic
_time is epoch. Although it looks like a character string.
opened is epoch, also. because you use strftime . OK?
How's this?

[itsmevic]

I thought for sure that might work, but for some reason, it's still not pulling the desired results.

[to4kawa]

index=dw sourcetype=*
| eval time=_time
|table opened _time time

please copy and paste this results.

[Anantha123]

Please try with below code
| rex field=Opened "(?[^\s]+)"
| eval "FTime"=strptime(opdate,"%Y-%m-%d")
| table FTime opdate _time
| rename _time as LTime
| eval duration = round((LTime-FTime)/86400)
| table duration
Hope this works

[Anantha123]

try this

| rename Opened as InTime | eval "FirstAuth"= strftime((InTime ),"%d.%m.%y")
| rename _time as OutTime | eval "LastAuth"= strftime((OutTime ),"%d.%m.%y")
|eval Lastloginduration = round((LastAuth-FirstAuth)/86400)
|table Lastloginduration