https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281558#M84974 <P>Going on your solution, I also evaluated "now" to its own value and limited it by only showing events where the start time is &gt; now</P> <PRE><CODE> yoursearchhere | eval start=strptime(PLANNED_START,"%Y-%m-%d %H:%M:%S.%Q") | eval boundaryDate = relative_time(now(),"+14d") | eval now=now() | where start &lt;= boundaryDate | where start &gt; now | table whateveryouwant </CODE></PRE> Thu, 15 Dec 2016 15:07:22 GMT jmaple 2016-12-15T15:07:22Z https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281553#M84969 <P>We've ingested some database tables for data that consists of changes being made in our environment. I'm looking to create a report that counts out two weeks at a time to find the next tasks that will occur. The timestamp we are reading is its own column so I evaluated that timestamp to a date and evaluated now.</P> <PRE><CODE>[base search] | eval start=strptime(PLANNED_START,"%Y-%m-%d %H:%M:%S.%Q") | eval startDate=strftime(start,"%Y-%m-%d") | eval now=now()| eval todayDate=strftime(now,"%Y-%m-%d") | [table output] </CODE></PRE> <P>From here, I want to be able to evaluate 14 days between "todayDate" and "startDate". What would be the best way to achieve this?</P> Wed, 14 Dec 2016 21:45:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281553#M84969 jmaple 2016-12-14T21:45:56Z https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281554#M84970 <P>First, "find the next tasks that will occur" sounds like you are looking for future events. And I don't know what "evaluate 14 days" means either.<BR /> Can you explain your input and your desired output?</P> Wed, 14 Dec 2016 23:10:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281554#M84970 lguinn2 2016-12-14T23:10:33Z https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281555#M84971 <P>So the PLANNED_START field is a column from a table in which a user inputs the value of when they plan to start the task (the task being the whole event itself). I'm trying to create a report that reads the "startDate" field and determines if the date is within the next two weeks from when the report is ran.</P> <P>Ideally this would be run every morning and show two weeks of tasks from that moment (todayDate). </P> Wed, 14 Dec 2016 23:43:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281555#M84971 jmaple 2016-12-14T23:43:00Z https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281556#M84972 <P>So, based on the comment, here is how to do what you want.</P> <PRE><CODE>yoursearchhere | eval start=strptime(PLANNED_START,"%Y-%m-%d %H:%M:%S.%Q") | eval boundaryDate = relative_time(now(),"+14d") | where start &lt;= boundaryDate | table whateveryouwant </CODE></PRE> <P>The relative_time function is super useful...</P> Thu, 15 Dec 2016 01:29:40 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281556#M84972 lguinn2 2016-12-15T01:29:40Z https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281557#M84973 <P>Doesn't seem to have the desired effect. It does cut the number of events down so it's doing something but it doesn't seem to be limited to the 14 days I want it to be limited to.</P> Thu, 15 Dec 2016 03:31:10 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281557#M84973 jmaple 2016-12-15T03:31:10Z https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281558#M84974 <P>Going on your solution, I also evaluated "now" to its own value and limited it by only showing events where the start time is &gt; now</P> <PRE><CODE> yoursearchhere | eval start=strptime(PLANNED_START,"%Y-%m-%d %H:%M:%S.%Q") | eval boundaryDate = relative_time(now(),"+14d") | eval now=now() | where start &lt;= boundaryDate | where start &gt; now | table whateveryouwant </CODE></PRE> Thu, 15 Dec 2016 15:07:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-a-search-to-count-14-days-between-now-and-a/m-p/281558#M84974 jmaple 2016-12-15T15:07:22Z