I need to perform a subtraction between two date fields in order to get a specific age. How can I do this?
Use strptime to convert to epoch then subtract and convert to years.
<base search> | eval age=floor((strptime(date1, "%d/%m/%y") - strptime(date2, "%d/%m/%y"))/(86400*365))
Sample query:
| makeresults | eval date1="02/20/1993", date2="03/04/2020"| eval age=floor((strptime(date2, "%m/%d/%Y") - strptime(date1, "%m/%d/%Y"))/(86400*365))
yoursearch |eval age=(biggerValue - smallerValue)
Going out on a bit of a limb, and guessing what you might be trying:
<your search which gives you a field called dob>
|eval dobEpoch=strptime(dob, "%d/%m/%Y")
|eval ageSeconds=(now() - dobEpoch)
|eval age=strftime(ageSeconds, %y)
|fields - dobEpoch, ageSeconds
|table dob age
This assumes you have a search which returns a field called dob in the format "21/12/1980"
It converts that date to an epoch time - "dobEpoch"
Subtracts the dob (in epoch) from the current epoch time (now) and saves that in "ageSeconds"
does a conversion from seconds into years and saves that in "age"
removes the two unnecessary calculation fields
displays a table of DOB and Age
Or the same query, with fewer steps:
<your search which gives you a field called dob>
|eval age=strftime((now() - strptime(dob, "%d/%m/%Y")), %y)
|table dob age