How to calculate age of event?

[ednk]

Hi 

I have for each event the open_time and update_time,

I want to calculate the age of the event,

like: 

open_time               update_time           age

2022-03-26            2022-04-26            1m

2022-04-22            2022-04-26             4d

any idea ?

thanks

[kamlesh_vaghela]

@ednk 

You can use tostring function to get age sorta from days. 

Can you please try this?

| makeresults | eval _raw="open_time               update_time           age
2022-02-26            2022-04-26            1m
2022-04-22            2022-04-26             4d" 
| multikv forceheader=1
|table open_time update_time 
| rename comment as "Upto now is for sample data only" 
| eval open_time = strptime(open_time, "%Y-%m-%d") 
| eval update_time = strptime(update_time, "%Y-%m-%d") 
| eval field_in_secs= update_time - open_time
| eval string_dur=tostring(field_in_secs, "duration")
| eval formatted_dur = replace(string_dur,"(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s")
| eval Age=replace(formatted_dur, "^d (0h (0m )?)?","")

 Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[ednk]

@kamlesh_vaghela 

thank you, 

this is what I got.

how can I remove the seconds and milliseconds?

open_time update_time Age field_in_secs formatted_dur string_dur

1645826400.000000	1650920400.000000	58d 23h 0m 0s.000000	5094000.000000	58d 23h 0m 0s.000000	58+23:00:00.000000
1650574800.000000	1650920400.000000	4d 0h 0m 0s.000000	345600.000000	4d 0h 0m 0s.000000	4+00:00:00.000000

[kamlesh_vaghela]

@ednk 

Please try this.

| makeresults | eval _raw="open_time               update_time           age
2022-02-26            2022-04-26            1m
2022-04-22            2022-04-26             4d" 
| multikv forceheader=1
|table open_time update_time 
| rename comment as "Upto now is for sample data only" 
| eval open_time = round(strptime(open_time, "%Y-%m-%d"))
| eval update_time = round(strptime(update_time, "%Y-%m-%d"))
| eval field_in_secs= update_time - open_time
| eval string_dur=tostring(field_in_secs, "duration")
| eval formatted_dur = replace(string_dur,"(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s")
| eval Age=replace(formatted_dur, "^d (0h (0m )?)?","")

KV