How to get last login from multiple date ?

[riposan]

please help,i used _time from date log, and i using time from windowstime, but i tried substraction bot of them not result in coloumn durationday

stats max(_time) as lastlogin by user |eval n=time()|eval today=strftime(n,"%m-%d-%Y %H:%M:%S.%Q")| eval durationday = lastlogin - today | table user,lastlogin,today,durationday

and result this

user lastlogin today durationday

dsadadnk12

01-30-2023 11:10:27.208

01-30-2023 11:25:14.000

[scelikok]

Hi @riposan,

You should calculate the duration before formatting the lastlogin. Please try below;

| stats max(_time) as lastlogin by user 
| eval n=time() 
| eval durationday = n-lastlogin 
| eval today=strftime(n,"%m-%d-%Y %H:%M:%S.%Q") 
| eval durationday= tostring(durationday,"duration") 
| table user,lastlogin,today,durationday

[riposan]

thx for reply my question. i tried this,still no result in coloumn durationday

[riposan]

after i tried change coloumn _time, its still work. thx