Subtracting time from search, from another specified time

[raby1996]

Hi all,
Currently I have the following search-

| eval nowstring=strftime(now(), "%Y-%m-%d")
| eval nowstring2=strptime(nowstring, "%Y-%m-%d")
| eval TD= (nowstring2- it3)/86400

where I'm taking the difference between the time the search runs ( nowstring and nowstring2) and the time I'm extracting from my search (TD), however instead of the nowstring I would like compare the times from different months lets say 08/01/2015 so it would be the time difference between my event and or events and 08/01/2015 , is there any way that I can do this?
Thank you.

[somesoni2 · Accepted solution]

First for your current query, you do it like this (to compare current day with timestamp in your events

 | eval nowstring=relative_time(now(), "@d")
 | eval TD= (nowstring- it3)/86400

For comparing against a specific date, you can do like this

| eval nowstring=strptime("2015-08-01", "%Y-%m-%d")
| eval TD= (nowstring- it3)/86400

For comparing against relative month start date, do like this

| eval nowstring=relative_time(now(), "@mon-2mon")
     | eval TD= (nowstring- it3)/86400

[raby1996]

Thank you!