Subtract date from todays date to find status of the project

[ranjitbrhm1]

Hello All, I am trying to injest into splunk a CSV which has a field called "Project End Date" and the field is in this format
11/7/2017 i.e dd/mm/yy. I am trying to find out how many days since the project is outstanding or how many days for the project to be completed.
Project_Title Project_Manager Task Start Date Task End Date Tasks Project Start Date Project End Date

Splunk Implementation user 2/2/2018 3/2/2018 Install os 2/2/2018 1/5/2018

Splunk Implementation user 2/2/2018 install universal forwarder in two linux 2/2/2018 1/5/2018

So basically i would need to subtract the project end date from the current date to see how many days the project is pending or how many days the project still have?
thanks

[cmerriman · Accepted solution]

put the Project End Date into epoch and then use eval to subtract now() from it

something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)

[ranjitbrhm1]

absolute spot on. But during that time instead of now() i actually converted _time back to epoch and then followed the remaining step. But your answer is 100% correct.
Thanks