Splunk Search

How to comparing 2 date fields and create a third with the difference

ajdyer2000
Path Finder

Event_Reported_Time Comment_Date Diff
7/21/2016 7/22/2016 1
7/24/2016 7/29/2016 5
8/16/2016 8/25/2016 9

Tags (2)
0 Karma

sbbadri
Motivator

| makeresults | eval Event_Reported_Time="7/21/2016" | eval Comment_Date="7/22/2016" | eval Event_Reported_Time = strptime(Event_Reported_Time,"%m/%d/%Y") | eval Comment_Date = strptime(Comment_Date,"%m/%d/%Y") | eval diff_time = Comment_Date - Event_Reported_Time | eval diff_days = diff_time / 86400

0 Karma

woodcock
Esteemed Legend

Like this:

... | foreach * [eval <<FIELD>>_Epoch = strptime(<<FIELD>>, "%m/%d/%Y")]
| eval Diff = (Comment_Date_Epoch - Event_Reported_Time_Epoch) / (60*60*24)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...