index=servicenow assignment_group_name="security" status=*
| stats count by number,status,group_name,created_on
The above query will produce the following:
I need to calculate the number days from the "created on" date shown above in the example to the current date.
Any help with this is greatly appreciated.
Add
| eval days=round((now() - strptime(created_on, "%d-%b-%y %H:%M:%S")) / 86400, 0)
to calculate days - this rounds to 0 decimal places. Change as required or use floor() to round down if wanted.
Thank you.
Add
| eval days=round((now() - strptime(created_on, "%d-%b-%y %H:%M:%S")) / 86400, 0)
to calculate days - this rounds to 0 decimal places. Change as required or use floor() to round down if wanted.