Duration with just days (2)

[Oisin77]

source="J:\\B6 Files\\Web Logs\\Vegas\\access_logs\\star.log" INFO star | rex field=_raw "INFO  (?<report>star)  - (?<username>.*) \| (?<month>[A-Za-z]+) (?<day>[0-9]+) (?<year>20[0-9]{2}) (?<time>.*) \| [A-Z]+ \| D \[RANGE\] (?<date1>[0-9]{8})-(?<date2>[0-9]{8})" | search username!="planitas" username!="antonio_rigon" | eval d1=strptime(date1, "%Y%m%d") | eval d2=strptime(date2, "%Y%m%d") |  eval d3=(d2-d1) | eval "diff_days"=tostring(d3,"duration") | rex field="diff_days" "(?<durationdays>^\d+)\+" | stats count(report) by diff_days

So even though I have it in the code, in statistics its not just the days are shown like its supposed to be, it has the + thing with hours, minutes, seconds, etc. Why is this?

[somesoni2 · Accepted solution]

Why don't you just divide the difference of dates with 86400 (equivalent to 1 day in sec).

source="J:\\B6 Files\\Web Logs\\Vegas\\access_logs\\star.log" INFO star | rex field=_raw "INFO  (?<report>star)  - (?<username>.*) \| (?<month>[A-Za-z]+) (?<day>[0-9]+) (?<year>20[0-9]{2}) (?<time>.*) \| [A-Z]+ \| D \[RANGE\] (?<date1>[0-9]{8})-(?<date2>[0-9]{8})" | search username!="planitas" username!="antonio_rigon" | eval d1=strptime(date1, "%Y%m%d") | eval d2=strptime(date2, "%Y%m%d") | eval diff_days=(d2-d1)/86400 | stats count(report) by diff_days

[Oisin77]

Great, thanks a lot.

[aholzer]

You are using "diff_days" in your stats call rather than the "durationdays". Try this instead:

... | stats count(report) by durationdays