Hi,
can somebody explain, why I dont get any results?
index=...
| eval Timestamp=strftime(_time,"%d-%m-%Y %H:%M:%S")
| eval CurrentTime=strftime(now(),"%d-%m-%Y %H:%M:%S")
| eval NotUsedFor=(CurrentTime-Timestamp)
| chart max(NotUsedFor) by host
I want a chart that shows the difference of the CurrentTime and the Timestamp
Hi @schufi01,
You must make calculation before formatting the timestamps;
index=...
| eval NotUsedFor=(now()-_time)
| chart max(NotUsedFor) by host
Hi @schufi01,
You must make calculation before formatting the timestamps;
index=...
| eval NotUsedFor=(now()-_time)
| chart max(NotUsedFor) by host