Splunk Search

How to comparing 2 date fields and create a third with the difference

ajdyer2000
Path Finder

Event_Reported_Time Comment_Date Diff
7/21/2016 7/22/2016 1
7/24/2016 7/29/2016 5
8/16/2016 8/25/2016 9

Tags (2)
0 Karma

sbbadri
Motivator

| makeresults | eval Event_Reported_Time="7/21/2016" | eval Comment_Date="7/22/2016" | eval Event_Reported_Time = strptime(Event_Reported_Time,"%m/%d/%Y") | eval Comment_Date = strptime(Comment_Date,"%m/%d/%Y") | eval diff_time = Comment_Date - Event_Reported_Time | eval diff_days = diff_time / 86400

0 Karma

woodcock
Esteemed Legend

Like this:

... | foreach * [eval <<FIELD>>_Epoch = strptime(<<FIELD>>, "%m/%d/%Y")]
| eval Diff = (Comment_Date_Epoch - Event_Reported_Time_Epoch) / (60*60*24)
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...