Hi all.
I have one field called **date1** with a timestamp like this:
> 5/7/16 16:35
I need the time difference (just for the date) in days against `now()`. I am using this expression:
... | eval onlydate=strftime(strptime(date1,"%-m/%d/%y %H:%M"),"%-m/%-d/%y") | eval nowstring=strftime(now(), "%-m/%-d/%y")
And works well, but I can't calculate the time difference between **nowstring** and **onlydate** and both are in the same format. Any clue? I tried using
... | eval difference=(nowstring - onlydate)
And didn't work.
Thanks!
↧