Calculating difference between two strftime fields

[jason_hotchkiss]

Hello Splunkers:

I'm looking to determine how many days file is out of date.

I have two strftime fields and values:

x = 1612285190.000
y = 1612303190.000000

I need to calculate the number of days between x and y, something like x - y = z.  

I tried: 
| eval z=x-y 

y calculates to -18000.00

I tried converting this using:
| eval x=strftime(z, "d%") and I get 31.  Which seems to be the 31st day of the month.  

Thanks in advance.

[scelikok · Accepted solution]

Hi @jason_hotchkiss,

You are very close, you can achieve this in two ways;

This will give you days;
| eval z=round((x-y)/86400,0)

This will give you timeformatted;
| eval z=tostring(x-y,"duration")

[jason_hotchkiss]

Awesome, thank you!