How to get the time difference after converting unix time using strftime?

[payton_tayvion]

I'm currently trying to get the duration of some events, but when i use this search nothing is coming back:

| tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature
| eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S")
| fields - first,last
|eval duration=last_time-first_time

The strftime command converts the unix time, but im not able to get the difference

[adonio]

maybe change the order:

| tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature 
| eval duration=last - first
| eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S") 
| fields - first,last duration

[payton_tayvion]

when i do it that way and convert the duration, the results are dates thats in 1970s vs it actually being the duration of the first and last time.