You can use tostring function to get age sorta from days.
Can you please try this?
| makeresults | eval _raw="open_time update_time age
2022-02-26 2022-04-26 1m
2022-04-22 2022-04-26 4d"
| multikv forceheader=1
|table open_time update_time
| rename comment as "Upto now is for sample data only"
| eval open_time = strptime(open_time, "%Y-%m-%d")
| eval update_time = strptime(update_time, "%Y-%m-%d")
| eval field_in_secs= update_time - open_time
| eval string_dur=tostring(field_in_secs, "duration")
| eval formatted_dur = replace(string_dur,"(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s")
| eval Age=replace(formatted_dur, "^d (0h (0m )?)?","")
Thanks
KV
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
thank you,
this is what I got.
how can I remove the seconds and milliseconds?
open_time update_time Age field_in_secs formatted_dur string_dur
1645826400.000000 | 1650920400.000000 | 58d 23h 0m 0s.000000 | 5094000.000000 | 58d 23h 0m 0s.000000 | 58+23:00:00.000000 |
1650574800.000000 | 1650920400.000000 | 4d 0h 0m 0s.000000 | 345600.000000 | 4d 0h 0m 0s.000000 | 4+00:00:00.000000 |
Please try this.
| makeresults | eval _raw="open_time update_time age
2022-02-26 2022-04-26 1m
2022-04-22 2022-04-26 4d"
| multikv forceheader=1
|table open_time update_time
| rename comment as "Upto now is for sample data only"
| eval open_time = round(strptime(open_time, "%Y-%m-%d"))
| eval update_time = round(strptime(update_time, "%Y-%m-%d"))
| eval field_in_secs= update_time - open_time
| eval string_dur=tostring(field_in_secs, "duration")
| eval formatted_dur = replace(string_dur,"(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s")
| eval Age=replace(formatted_dur, "^d (0h (0m )?)?","")
KV