topic Re: Evaluate difference between 2 (string) dates in the same event. in Splunk Search

Evaluate difference between 2 (string) dates in the same event.

bjbrookz — Wed, 17 Jul 2024 01:07:42 GMT

Hello, I'm struggling mightily with this one. I have two dates in the same event, both are strings. Their format is below. I would like to evaluate the number of days between the firstSeen and lastSeen dates. I would also like to evaluate the number of days since firstSeen and when the search is performed. Any help would be much appreciated...

firstSeen: Aug 27, 2022 20:18:37 UTC

lastSeen: Jun 23, 2024 06:17:25 UTC

Re: Evaluate difference between 2 (string) dates in the same event.

Tom_Lundie — Wed, 17 Jul 2024 01:25:19 GMT

Hi,

You can do that with an eval command.

| eval firstSeenTS = strptime(firstSeen, "%b %d, %Y %H:%M:%S %Z"), lastSeenTS = strptime(lastSeen, "%b %d, %Y %H:%M:%S %Z"), firstLastDiff = (lastSeenTS - firstSeenTS)/86400, firstNowDiff = (now() - firstSeenTS)/86400

If you want to round your days down to whole numbers you can use floor()

Re: Evaluate difference between 2 (string) dates in the same event.

bjbrookz — Wed, 17 Jul 2024 01:43:46 GMT

Outstanding. That worked perfectly. Thank you.