https://community.splunk.com/t5/Splunk-Search/how-to-calculate-days-between-two-dates-and-also-how-to/m-p/435504#M170635 <P>| eval duedate1 = strftime(strptime(duedate,"%Y-%m-%d"),"%Y-%m-%d %H:%M:%S")<BR /> | eval current = strftime(now(),"%Y-%m-%d %H:%M:%S") <BR /> | eval daysdiff=round((current-duedate1)/86400,0)<BR /> | table current duedate1 daysdiff</P> Thu, 20 Jun 2019 06:02:00 GMT chandanimishra 2019-06-20T06:02:00Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-days-between-two-dates-and-also-how-to/m-p/435504#M170635 <P>| eval duedate1 = strftime(strptime(duedate,"%Y-%m-%d"),"%Y-%m-%d %H:%M:%S")<BR /> | eval current = strftime(now(),"%Y-%m-%d %H:%M:%S") <BR /> | eval daysdiff=round((current-duedate1)/86400,0)<BR /> | table current duedate1 daysdiff</P> Thu, 20 Jun 2019 06:02:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-days-between-two-dates-and-also-how-to/m-p/435504#M170635 chandanimishra 2019-06-20T06:02:00Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-days-between-two-dates-and-also-how-to/m-p/435505#M170636 <P>Differences between timestamps must be calculated using the epoch form of timestamp. Try this:</P> <PRE><CODE>| eval duedate1 = strptime(duedate,"%Y-%m-%d") | eval current = now() | eval daysdiff=round((current-duedate1)/86400,0) | eval today = strftime(current, "%Y-%m-%d %H:%M:%S") | table today duedate daysdiff </CODE></PRE> Thu, 20 Jun 2019 12:58:28 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-days-between-two-dates-and-also-how-to/m-p/435505#M170636 richgalloway 2019-06-20T12:58:28Z