I found that:
| eval duration=strftime(lastSeen-firstSeen,"%d")
Would always return the day of the month (1 through 31) and not the duration. I ended up using:
| eval duration_in_days=(lastSeen-firstSeen)/86400
instead which I believe will return the amount of days past.
... View more