Splunk Search

calculate the days between 2 dates

HattrickNZ
Motivator

this is my search:

| makeresults count=2 | 
eval start=relative_time(now(),"@d") | 
eval start_string=strftime(start,"%Y-%m-%d") | 
eval end=strptime("1 jan 2017","%d %b %Y") | 
eval end_string=strftime(end,"%Y-%m-%d") | 
eval start_minus_end=end-start/1400

give s me the following:

_time   end end_string  start   start_minus_end start_string
1   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20
2   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20

How do I work out how many days are between start_string and end_string?
I have tried to do this with eval start_minus_end=end-start/1400 but i am not sure what value start_string is? is it milliseconds?

As an aside I would then like to store this value in a variable that I can somehow use in the predict function and assign it to future_timespan e.g. predict kpi1 as kpi1 future_timespan=<VARIABLE> holdback=1

Tags (4)
0 Karma

maciep
Champion

Splunk also has a tostring function that allows you to, among other things, convert seconds to a duration. The result is in the format of days+HH:MM:SS

| eval duration = tostring(end - start,"duration")

So in your case the result for today is 257+01:00:00.000000

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi HattrickNZ,

epoch is time in seconds so replace the last eval with this:

 eval start_minus_end=round((end-start)/86400,0)

and you will get the numbers of days.
This is the result:

alt text
Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...