Hello Splunkers,
How would I be able to calculate the number of days between todays days which I'm using the now() function, and the date stored the transaction accorded? The way transaction dates appear on our system is in a (mmddYYYY) format so for example 02052018.
I'm trying to use strfttime(OPEN_DATE,"%m,%d,$Y") but it converts every date into a calendar date ending in 1970.
try this in your search:
| eval days=(now()-strptime(OPEN_DATE, "%m%d%Y"))/86400
now() is epoch time (seconds since Jan 1st 1970 GMT)
strptime(OPEN_DATE, "%m%d%Y") should give you seconds since Jan 1st 1970 GMT for OPEN_DATE
now() - strptime(OPEN_DATE, "%m%d%Y") = difference in epoch times for now and OPEN_DATE
Divided by 86400 gives you the difference in days. You might want to round it too:
| eval days=round((now()-strptime(OPEN_DATE, "%m%d%Y"))/86400,2)
try this:
|makeresults|eval starttime="02042018" |eval time=strptime(starttime,"%m%d%Y")|eval days=floor((now()-time)/86400)
| eval seconds_since_open_date=now()-strptime(OPEN_DATE, "%m%d%Y"), days_since_open_date=seconds_since_open_date/86400
It looks like you were using strftime (format) instead of strptime (parse), and you also had commas in your format string, but had none in your sample date string.
try this in your search:
| eval days=(now()-strptime(OPEN_DATE, "%m%d%Y"))/86400
now() is epoch time (seconds since Jan 1st 1970 GMT)
strptime(OPEN_DATE, "%m%d%Y") should give you seconds since Jan 1st 1970 GMT for OPEN_DATE
now() - strptime(OPEN_DATE, "%m%d%Y") = difference in epoch times for now and OPEN_DATE
Divided by 86400 gives you the difference in days. You might want to round it too:
| eval days=round((now()-strptime(OPEN_DATE, "%m%d%Y"))/86400,2)
Thank you, now I'm getting the answers I need. Nice addition of the round function too.