calculate Difference between 2 time fields is not working.

[nivethainspire_]

I tried to difference between 2 dates. It is not working properly.

Here is my query,

index=s_iss sourcetype=S_AD | fillnull value="" |eval Last_Date="2019-09-28 17:09:19.0"|eval _time="2019-05-21 4:55:00.143" | eval Last_Date=strftime(strptime(Last_Date,"%Y-%m-%d %H:%M:%S.%Q"),"%Y-%m-%d") | eval _time = strptime(_time, "%Y-%m-%d") | eval diff = ( _time - Last_Date)|stats count by Name,Last_Date,_time,diff

I need the time difference between Last_date and now() and display as Date.
Can someone help me out.

[to4kawa]

index=s_iss sourcetype=S_AD Name=*
| eval Last_Date = "2019-09-28 17:09:19"
| eval diff=_time - strptime(Last_Date,"%F %T")
| eval Last_Date=mvindex(split(Last_Date," "),0)
| table _time diff Name Last_Date

Why do you calculate now() and Last_Date?
It is fixed value.

This query aims to calculate the diff between _time and Last_Date .
How about this?

[gcusello]

Hi @nivethainspire_07,
in you example _time is a variable that you need to convert in epochtime (with strptime), in real events, you don't need to do this convertion because _time is already in epochtime.

Then, in your example, you don't calculate the difference between now and Last_Date but the difference between _time and Last_Date.
Then if you want to use _time in stats, you have to group values (using bin command) before stats or you have to use timechart command.

So, if you want the difference between Last_Date and now, you could try something like this.

index=s_iss sourcetype=S_AD 
| fillnull value="" 
| eval diff=now()-strptime(Last_Date,"%Y-%m-%d %H:%M:%S.%Q")
| timechart span=1h latest(diff) AS date by Name

Ciao.
Giuseppe