topic Re: Calculating difference between two strftime fields in Splunk Search

Calculating difference between two strftime fields

jason_hotchkiss — Tue, 02 Feb 2021 18:00:03 GMT

Hello Splunkers:

I'm looking to determine how many days file is out of date.

I have two strftime fields and values:

x = 1612285190.000
y = 1612303190.000000

I need to calculate the number of days between x and y, something like x - y = z.

I tried:
| eval z=x-y

y calculates to -18000.00

I tried converting this using:
| eval x=strftime(z, "d%") and I get 31. Which seems to be the 31st day of the month.

Thanks in advance.

Re: Calculating difference between two strftime fields

scelikok — Tue, 02 Feb 2021 18:53:00 GMT

Hi @jason_hotchkiss,

You are very close, you can achieve this in two ways;

This will give you days; | eval z=round((x-y)/86400,0)

This will give you timeformatted; | eval z=tostring(x-y,"duration")

Re: Calculating difference between two strftime fields

jason_hotchkiss — Tue, 02 Feb 2021 19:30:17 GMT

Awesome, thank you!