Hi all,
I'm trying to calculate the difference between two dates my search regarding this looks as follows (forgive the messiness, i know it seems a bit redundant)-
| eval it = strptime(Load_Time, "%Y/%m/%d")
| eval ot = strptime(Time, "%Y/%m/%d %I:%M:%S")
| eval it2 = strftime(it, "%Y/%m/%d")
| eval ot2 = strftime(ot, "%Y/%m/%d")
| eval it3 = strptime(it2, "%Y/%m/%d")
| eval ot3 = strptime(ot2, "%Y/%m/%d")
| eval TimeDiff= ot3-it3
| eval TimeDiff2=strftime(TimeDiff, "%j")|
| dedup it2, MTMS
| dedup MTMS, Time
| sort -Load_Time
| stats list(LIC) as LIC count list(MTMS) AS MTMS , list(it2) AS LoadTime, list(ot2) As EventDate, list(TimeDiff2) AS Time_Difference ,sum(TimeDiff2) AS Sum, by Bundle
| eval Machine_Months=Sum/30.4
| sort -Bundle
The problem with this is that the results (difference) I'm given is in Epoch format which I can't use to do the calculations that follow (dividing the sum of all differences by 30.4) and if I use strftime to convert it, then I can only go up to 365 days (using %j ) which isn't a big enough number as some of these differences go beyond that, and for the dates that are the same, lets say 2015/07/09 and 2015/07/09 I get 365 instead of 0
So my overall goal is to get a difference between these dates in a number format that isn't based on dates (so 0 to infinity NOT 0 to 365 or 0 to 31 etc...)
Thank you!
