I hold a list of two dates that I want to subtract one from another
these dates are an outcome from:
|convert timeformat="%Y-%m-%d" ctime(_time) AS date1
source:
| date1 | date2 |
|2017-12-08 | 2017-12-05 |
|2017-12-04 | 2017-12-05 |
|2017-12-05 | 2017-12-05 |
Wanted outcom:
| date 1 | date 2 | diff |
|2017-12-08 | 2017-12-05 | 3 |
|2017-12-04 | 2017-12-05 | 1 |
|2017-12-05 | 2017-12-05 | 0 |
Hi @eranday,
Can you please try this search?
YOUR_SEARCH
| eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400)
| eval diff=mvcount(dates)
My Sample Search:
| makeresults
| eval date1="2017-12-08" , date2="2017-12-05"
| eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400)
| eval diff=mvcount(dates)
Thanks
@eranday
Please try below,
| makeresults | eval d1="2017-12-08" | eval d2="2017-12-05" | eval da1=strptime(d1,"%Y-%m-%d") | eval da2=strptime(d2,"%Y-%m-%d") | eval diff=da1-da2 | eval diff=strftime(diff,"%d")
@eranday, please try the following runanywhere search,
| makeresults
| eval date2=relative_time(_time,"-3d")
| eval date1=strftime(_time,"%Y%m%d")
| eval date2=strftime(date2,"%Y%m%d")
| eval diff=date1-date2
You can replace first two pipes with your query to get date1 and date2 as epoch time. I have used relative_time
function to get dummy data which is 3 days prior i.e. -3d
.
Hi @eranday,
Can you please try this search?
YOUR_SEARCH
| eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400)
| eval diff=mvcount(dates)
My Sample Search:
| makeresults
| eval date1="2017-12-08" , date2="2017-12-05"
| eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400)
| eval diff=mvcount(dates)
Thanks
not working
search updated pls try it.
Champ!! it works
Thanks
Great.. !!
Can you please accept the answer to close this question?
Thanks
Happy Splunking