https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445504#M126378 <P>Hi @kmaron above answer help me getting the days difference. Could you help me to count hour difference if daysdiff is less than 1.</P> Fri, 07 Sep 2018 08:34:21 GMT twh1 2018-09-07T08:34:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445501#M126375 <P>I have two dates as part of a string. I have to get these dates in separate fields by using the substr function. Now, I want to calculate the number of days difference between those two dates.</P> <PRE><CODE>| base search | eval date1=substr(HIGH_VALUE, 10, 19) | eval date2=substr(PREV_HIGH_VALUE, 10, 19) | eval it = strptime(date1, "%Y-%m-%d %H:%M:%S") | eval ot = strptime(date2, "%Y-%m-%d %H:%M:%S") | eval diff = (it - ot) | eval date_diff=strftime(diff,"%Y-%m-%d %H:%M:%S") </CODE></PRE> <P>I am unable to get the desired result by the above query. </P> <P>I have to calculate a new field data based on number of difference between two dates.</P> Thu, 06 Sep 2018 17:27:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445501#M126375 twh1 2018-09-06T17:27:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445502#M126376 <P>Hi @twh1,</P> <P>Try below query</P> <PRE><CODE>| base search | eval date1=substr(HIGH_VALUE, 10, 19) | eval date2=substr(PREV_HIGH_VALUE, 10, 19) | eval it = strptime(date1, "%Y-%m-%d %H:%M:%S") | eval ot = strptime(date2, "%Y-%m-%d %H:%M:%S") | eval diff = (it - ot) | eval daysBetween=round(diff/86400,2) </CODE></PRE> Thu, 06 Sep 2018 17:45:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445502#M126376 harsmarvania57 2018-09-06T17:45:42Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445503#M126377 <P>try this:</P> <PRE><CODE>| base search | eval date1=substr(HIGH_VALUE, 10, 19) | eval date2=substr(PREV_HIGH_VALUE, 10, 19) | eval it = strptime(date1, "%Y-%m-%d %H:%M:%S") | eval ot = strptime(date2, "%Y-%m-%d %H:%M:%S") | eval daysdiff=round((ot-it)/86400,0) </CODE></PRE> Thu, 06 Sep 2018 17:53:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445503#M126377 kmaron 2018-09-06T17:53:08Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445504#M126378 <P>Hi @kmaron above answer help me getting the days difference. Could you help me to count hour difference if daysdiff is less than 1.</P> Fri, 07 Sep 2018 08:34:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445504#M126378 twh1 2018-09-07T08:34:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445505#M126379 <P>The 86400 is the number of seconds in a day. So if you want hours instead just use 3600 instead. </P> <PRE><CODE> | eval hoursdiff=round((ot-it)/3600,0) </CODE></PRE> <P>you could do some math in order to get days and hours so you always have both. </P> <PRE><CODE> | eval daysdiff=round((ot-it)/86400,0) | eval hoursleft=(round((ot-it)/3600,0)-(daysdiff*24)) </CODE></PRE> Fri, 07 Sep 2018 12:04:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-number-of-days-between-two-dates/m-p/445505#M126379 kmaron 2018-09-07T12:04:06Z