https://community.splunk.com/t5/Splunk-Search/How-to-subtract-quot-10-JAN-2012-11-JAN-2010-quot/m-p/65602#M180392 <P>Hi </P> <P>Not sure about your question, i.e. exactly what you want to subtract, but with <CODE>eval</CODE>, you can accomplish at least the following type of calculations. Since I didn't have your data, I had to manufacture it ( the first 4 rows). The <CODE>table</CODE> at the end shows all numbers/fields involved. The <CODE>diff</CODE> (in seconds) is equal to 1 day.</P> <PRE><CODE>index=main | head 1 | eval j1="10-JAN-2012" | eval j2="11-JAN-2012" | eval d1=strptime(j1,"%d-%b-%Y") | eval d2=strptime(j2,"%d-%b-%Y") | eval diff = d2-d1 | table j1 j2 d1 d2 diff </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> <P>Don't be afraid to post some sample events. You'd be able to get better help that way.</P> Tue, 19 Mar 2013 09:37:48 GMT kristian_kolb 2013-03-19T09:37:48Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-quot-10-JAN-2012-11-JAN-2010-quot/m-p/65601#M180391 <P>Here JAN is String so we can not subtract... is there any command which converts JAN to 1 or FEB to 2 so on please help me out....</P> <P>i have tried with "Convert" command but i am not getting it </P> Tue, 19 Mar 2013 08:53:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-quot-10-JAN-2012-11-JAN-2010-quot/m-p/65601#M180391 renuka13 2013-03-19T08:53:03Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-quot-10-JAN-2012-11-JAN-2010-quot/m-p/65602#M180392 <P>Hi </P> <P>Not sure about your question, i.e. exactly what you want to subtract, but with <CODE>eval</CODE>, you can accomplish at least the following type of calculations. Since I didn't have your data, I had to manufacture it ( the first 4 rows). The <CODE>table</CODE> at the end shows all numbers/fields involved. The <CODE>diff</CODE> (in seconds) is equal to 1 day.</P> <PRE><CODE>index=main | head 1 | eval j1="10-JAN-2012" | eval j2="11-JAN-2012" | eval d1=strptime(j1,"%d-%b-%Y") | eval d2=strptime(j2,"%d-%b-%Y") | eval diff = d2-d1 | table j1 j2 d1 d2 diff </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> <P>Don't be afraid to post some sample events. You'd be able to get better help that way.</P> Tue, 19 Mar 2013 09:37:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-quot-10-JAN-2012-11-JAN-2010-quot/m-p/65602#M180392 kristian_kolb 2013-03-19T09:37:48Z