Calculate difference between 2 timestamps in days?

[AzmathShaik]

i 'm trying to calculate the difference between two timestamps in number of days. here is my query
base_search
| eval intime = strptime(minTime, "%Y-%m-%dT%H:%M:%S")
| eval outtime = strptime(maxTime, "%Y-%m-%dT%H:%M:%S")
| eval timediffindays = tostring((outtime - intime), "duration")

my timestamp filed looks like "2019-09-23T18:51:52+0000"

my outcome looks like " 367+01:43:52.000000"

i am expecting to see the results in number of days

Thanks
Azmath

[richgalloway]

What tostring gave you is a number of days. It also expressed the remainder in terms of hours, minutes, and seconds.
If you only want days, try this:

| eval intime = strptime(minTime, "%Y-%m-%dT%H:%M:%S")
| eval outtime = strptime(maxTime, "%Y-%m-%dT%H:%M:%S")
| eval timediffindays = (outtime - intime)/86400