https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238688#M176553 <P>index=xyz| eval OldTime = relative_time(now(),"-60d") | table OldTime timestamp | eval OldTime=strftime(OldTime,"%Y-%m-%d %H:%M:%S")</P> <P>This should work @balleste</P> Fri, 07 Oct 2016 12:36:38 GMT vr2312 2016-10-07T12:36:38Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238686#M176551 <P>Hello,</P> <P>I have the following output:</P> <P>"ACME Enterprises","227671","<A href="mailto:bugs.bunny@acme.com">bugs.bunny@acme.com</A>","","","2016-10-01","14:18:11","Entertainment","Test"</P> <P>I wanted to calculate today's date minus the date in the output (2016-06-30) and table like so:</P> <P>ACME Enterprises, 2016-06-30, 6</P> <P>Any help would be great.</P> Fri, 07 Oct 2016 10:35:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238686#M176551 balleste 2016-10-07T10:35:29Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238687#M176552 <P>Not very sure if I understood your question. You want to take 07/Oct - 01/Oct and receive 30/Jun??</P> Fri, 07 Oct 2016 11:43:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238687#M176552 gfreitas 2016-10-07T11:43:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238688#M176553 <P>index=xyz| eval OldTime = relative_time(now(),"-60d") | table OldTime timestamp | eval OldTime=strftime(OldTime,"%Y-%m-%d %H:%M:%S")</P> <P>This should work @balleste</P> Fri, 07 Oct 2016 12:36:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238688#M176553 vr2312 2016-10-07T12:36:38Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238689#M176554 <P>There is no built-in function to subtract dates. You must first convert both dates into epoch form, do the calculation, then convert the result into readable form.</P> <PRE><CODE>... | eval eDate = strptime(&lt;your date field&gt;,"%Y/%m/%d") | eval days = (now() - eDate)/86400 | table foo, &lt;your date field&gt;, days </CODE></PRE> Fri, 07 Oct 2016 12:50:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238689#M176554 richgalloway 2016-10-07T12:50:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238690#M176555 <PRE><CODE>...|convert mktime(_time) as time|eval days=round((now()-time)/86400,0) </CODE></PRE> <P>possibly something like this. mktime converts human readable to epoch, then using that to subtract from the current timestamp and dividing by the seconds in a day, that should give you total days.</P> Fri, 07 Oct 2016 14:43:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238690#M176555 cmerriman 2016-10-07T14:43:43Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238691#M176556 <P>You need to use <CODE>epoch</CODE> times and the <CODE>relative_time</CODE> command with <CODE>-60d</CODE>:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions</A></P> Sat, 08 Oct 2016 20:53:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-a-specific-date-and-the/m-p/238691#M176556 woodcock 2016-10-08T20:53:50Z