Difference between two dates

[kanalasreekanth]

I have two fileds as below, now i would like to get difference date i.e Mydat-previousdate

Mydate | previousdate
2016-10-18T03:58:46 |152 day(s), 16 hour(s), 58 minute(s), 49 second(s)

[richgalloway]

Something like this should get you started.

... | rex field=previousdate "(?<days>\d+) day\(s\), (?<hrs>\d+) hour\(s\), (?<min>\d+) minute\(s\), (?<secs>\d+) second\(s\)" | fillnull value=0 | eval diff = strptime(Mydate,"%Y-%m-%dT%H:%M:%S") - (days * 86400) - (hrs * 3600) - (min * 60) - secs | eval diffDate = strftime(diff,"%Y-%m-%dT%H:%M:%S") | ...