How can I create a nowdiff:
FROM *.events.* | limit 1 | EVAL mynow=now() | KEEP time,mynow
time mynow
2023-05-20T03:22:16.976Z 2025-01-17T10:07:54.328Z
But:
FROM *.events.* | limit 1 | EVAL mynow=now()-time | KEEP time,mynow
BadRequestError(400, 'verification_exception', 'Found 1 problem\nline 1:52: [-] has arguments with incompatible types [datetime] and [datetime]')
I would have had a clue if the type was different
I can subtract timediffs:
FROM *.events.* | limit 1 | EVAL mynow = NOW() - 1 day | KEEP time,mynow
time mynow
2023-04-30T03:23:04.498Z 2025-01-16T10:15:35.728Z
Thanks