topic calculate the days between 2 dates in Splunk Search

calculate the days between 2 dates

HattrickNZ — Tue, 19 Apr 2016 22:23:59 GMT

this is my search:

| makeresults count=2 | 
eval start=relative_time(now(),"@d") | 
eval start_string=strftime(start,"%Y-%m-%d") | 
eval end=strptime("1 jan 2017","%d %b %Y") | 
eval end_string=strftime(end,"%Y-%m-%d") | 
eval start_minus_end=end-start/1400

give s me the following:

_time   end end_string  start   start_minus_end start_string
1   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20
2   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20

How do I work out how many days are between start_string and end_string?
I have tried to do this with eval start_minus_end=end-start/1400 but i am not sure what value start_string is? is it milliseconds?

As an aside I would then like to store this value in a variable that I can somehow use in the predict function and assign it to future_timespan e.g. predict kpi1 as kpi1 future_timespan=<VARIABLE> holdback=1

Re: calculate the days between 2 dates

MuS — Tue, 19 Apr 2016 22:34:06 GMT

Hi HattrickNZ,

epoch is time in seconds so replace the last eval with this:

 eval start_minus_end=round((end-start)/86400,0)

and you will get the numbers of days.
This is the result:

Hope this helps ...

cheers, MuS

Re: calculate the days between 2 dates

maciep — Tue, 19 Apr 2016 23:09:32 GMT

Splunk also has a tostring function that allows you to, among other things, convert seconds to a duration. The result is in the format of days+HH:MM:SS

| eval duration = tostring(end - start,"duration")

So in your case the result for today is 257+01:00:00.000000