Hi all,
Currently I have the following search-
| eval nowstring=strftime(now(), "%Y-%m-%d")
| eval nowstring2=strptime(nowstring, "%Y-%m-%d")
| eval TD= (nowstring2- it3)/86400
where I'm taking the difference between the time the search runs ( nowstring and nowstring2) and the time I'm extracting from my search (TD), however instead of the nowstring I would like compare the times from different months lets say 08/01/2015 so it would be the time difference between my event and or events and 08/01/2015 , is there any way that I can do this?
Thank you.
↧