https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172806#M49561 <P>There are two <CODE>eval</CODE> functions for this, <CODE>now()</CODE> and <CODE>time()</CODE>. The major distinction is that <CODE>now()</CODE> will be stable over a long-running search while <CODE>time()</CODE> will yield a potentially new timestamp for every event/row/invocation... usually you'll want <CODE>now()</CODE> like this:</P> <PRE><CODE>... | stats latest(_time) as last_seen | eval days_since = (now() - last_seen) / 86400 | eval duration_since = tostring(now() - last_seen, "duration") </CODE></PRE> <P>I've included a fancy way of displaying a duration in days, hours, minutes, seconds and subseconds as well - see what you actually want and use that.</P> Fri, 17 Oct 2014 22:48:01 GMT martin_mueller 2014-10-17T22:48:01Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172804#M49559 <P>Hi All,</P> <P>I might be over thinking this one, but since I've already used _time--&gt; ...| stats earliest(_time) as first_seen, latest(_time) as last_seen, ... |, is it possible find the "current_time"?</P> <P>What I want to do is do something like ..| eval days_since=(current_time-last_seen)</P> <P>Is this possible?</P> <P>Thanks!</P> Mon, 28 Sep 2020 17:56:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172804#M49559 _gkollias 2020-09-28T17:56:45Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172805#M49560 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/174728">@_gkollias</a></P> <P>Are you looking for something like this?</P> <P>...| eval days_since=(now()-last_seen)</P> Mon, 28 Sep 2020 17:54:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172805#M49560 ppablo 2020-09-28T17:54:38Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172806#M49561 <P>There are two <CODE>eval</CODE> functions for this, <CODE>now()</CODE> and <CODE>time()</CODE>. The major distinction is that <CODE>now()</CODE> will be stable over a long-running search while <CODE>time()</CODE> will yield a potentially new timestamp for every event/row/invocation... usually you'll want <CODE>now()</CODE> like this:</P> <PRE><CODE>... | stats latest(_time) as last_seen | eval days_since = (now() - last_seen) / 86400 | eval duration_since = tostring(now() - last_seen, "duration") </CODE></PRE> <P>I've included a fancy way of displaying a duration in days, hours, minutes, seconds and subseconds as well - see what you actually want and use that.</P> Fri, 17 Oct 2014 22:48:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172806#M49561 martin_mueller 2014-10-17T22:48:01Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172807#M49562 <P>This is more towards what I am looking for! Is there a way to measure by day(s)? Here is a screenshot using your answer:</P> <P><A href="http://screencast.com/t/9yVnvtpl" target="_blank">http://screencast.com/t/9yVnvtpl</A></P> <P>I'd like to be able to show something like "Today", 1 Day, or if greater than 1 , "x Days". Here is what I was thinking using the case function:</P> <P>| eval days_since_last_txn=case(days_since_last_txn=0,"Today",days_since_last_txn=1,"1 Day",days_since_last_txn&gt;1, days_since_last_txn."[".Days."]") </P> <P>This didn't work for me, but do you have any insight on rounding by number of days?</P> <P>Thank you!</P> Mon, 28 Sep 2020 17:56:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172807#M49562 _gkollias 2020-09-28T17:56:48Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172808#M49563 <P>So... this?</P> <PRE><CODE>... | eval days_since = floor((now() - last_seen) / 86400) | eval days_since_pretty = case(days_since == 0, "Today", days_since == 1, "1 Day", days_since &gt; 1, days_since . " Days") </CODE></PRE> Sat, 18 Oct 2014 00:30:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172808#M49563 martin_mueller 2014-10-18T00:30:14Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172809#M49564 <P>Thank you!</P> Sat, 18 Oct 2014 04:41:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172809#M49564 _gkollias 2014-10-18T04:41:03Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172810#M49565 <P>Pipe reltime to original query which created a field reltime to give time difference between now and _time in humar readable form.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Reltime">http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Reltime</A></P> Mon, 18 Jul 2016 10:37:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/172810#M49565 niketn 2016-07-18T10:37:17Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/603417#M209994 <P>Thanks martin_mueller.</P><P>That also what I want.</P> Mon, 27 Jun 2022 16:08:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-time-difference-in-days-between-the-time-of-an/m-p/603417#M209994 Rithekakan 2022-06-27T16:08:07Z