Hello All, I am trying to injest into splunk a CSV which has a field called "Project End Date" and the field is in this format
11/7/2017 i.e dd/mm/yy. I am trying to find out how many days since the project is outstanding or how many days for the project to be completed.
Project_Title Project_Manager Task Start Date Task End Date Tasks Project Start Date Project End Date
Splunk Implementation user 2/2/2018 3/2/2018 Install os 2/2/2018 1/5/2018
Splunk Implementation user 2/2/2018 install universal forwarder in two linux 2/2/2018 1/5/2018
So basically i would need to subtract the project end date from the current date to see how many days the project is pending or how many days the project still have?
thanks
put the Project End Date into epoch and then use eval to subtract now()
from it
something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)
put the Project End Date into epoch and then use eval to subtract now()
from it
something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)
absolute spot on. But during that time instead of now() i actually converted _time back to epoch and then followed the remaining step. But your answer is 100% correct.
Thanks