Something like this?
... | eval ddate_epoch = strptime(ddate, "%Y-%m-%d %H:%M:%S") | eval diff_seconds = now() - ddate_epoch | eval diff_days = diff_seconds / 86400
Something like this?
... | eval ddate_epoch = strptime(ddate, "%Y-%m-%d %H:%M:%S") | eval diff_seconds = now() - ddate_epoch | eval diff_days = diff_seconds / 86400
Ah I see what I was doing wrong now! Thank you so much Martin!!!!!!!