https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335452#M99644 <P>@eranday, please try the following runanywhere search, </P> <PRE><CODE>| makeresults | eval date2=relative_time(_time,"-3d") | eval date1=strftime(_time,"%Y%m%d") | eval date2=strftime(date2,"%Y%m%d") | eval diff=date1-date2 </CODE></PRE> <P>You can replace first two pipes with your query to get date1 and date2 as epoch time. I have used <CODE>relative_time</CODE> function to get dummy data which is 3 days prior i.e. <CODE>-3d</CODE>.</P> Mon, 11 Dec 2017 10:39:55 GMT niketn 2017-12-11T10:39:55Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335450#M99642 <P>I hold a list of two dates that I want to subtract one from another<BR /> these dates are an outcome from: <BR /> |convert timeformat="%Y-%m-%d" ctime(_time) AS date1</P> <P>source:<BR /> | date1 | date2 |<BR /> |2017-12-08 | 2017-12-05 |<BR /> |2017-12-04 | 2017-12-05 |<BR /> |2017-12-05 | 2017-12-05 |</P> <P>Wanted outcom:<BR /> | date 1 | date 2 | diff |<BR /> |2017-12-08 | 2017-12-05 | 3 |<BR /> |2017-12-04 | 2017-12-05 | 1 |<BR /> |2017-12-05 | 2017-12-05 | 0 |</P> Mon, 11 Dec 2017 10:10:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335450#M99642 eranday 2017-12-11T10:10:58Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335451#M99643 <P>Hi @eranday,</P> <P>Can you please try this search?</P> <PRE><CODE>YOUR_SEARCH | eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400) | eval diff=mvcount(dates) </CODE></PRE> <P>My Sample Search:</P> <PRE><CODE>| makeresults | eval date1="2017-12-08" , date2="2017-12-05" | eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400) | eval diff=mvcount(dates) </CODE></PRE> <P>Thanks</P> Mon, 11 Dec 2017 10:25:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335451#M99643 kamlesh_vaghela 2017-12-11T10:25:46Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335452#M99644 <P>@eranday, please try the following runanywhere search, </P> <PRE><CODE>| makeresults | eval date2=relative_time(_time,"-3d") | eval date1=strftime(_time,"%Y%m%d") | eval date2=strftime(date2,"%Y%m%d") | eval diff=date1-date2 </CODE></PRE> <P>You can replace first two pipes with your query to get date1 and date2 as epoch time. I have used <CODE>relative_time</CODE> function to get dummy data which is 3 days prior i.e. <CODE>-3d</CODE>.</P> Mon, 11 Dec 2017 10:39:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335452#M99644 niketn 2017-12-11T10:39:55Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335453#M99645 <P>not working</P> Mon, 11 Dec 2017 10:41:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335453#M99645 eranday 2017-12-11T10:41:00Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335454#M99646 <P>search updated pls try it.</P> Mon, 11 Dec 2017 11:26:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335454#M99646 kamlesh_vaghela 2017-12-11T11:26:00Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335455#M99647 <P>@eranday</P> <P>Please try below,</P> <PRE><CODE>| makeresults | eval d1="2017-12-08" | eval d2="2017-12-05" | eval da1=strptime(d1,"%Y-%m-%d") | eval da2=strptime(d2,"%Y-%m-%d") | eval diff=da1-da2 | eval diff=strftime(diff,"%d") </CODE></PRE> Mon, 11 Dec 2017 15:10:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335455#M99647 sbbadri 2017-12-11T15:10:25Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335456#M99648 <P>Champ!! it works<BR /> Thanks</P> Tue, 12 Dec 2017 09:58:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335456#M99648 eranday 2017-12-12T09:58:53Z https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335457#M99649 <P>Great.. !!</P> <P>Can you please accept the answer to close this question?</P> <P>Thanks<BR /> Happy Splunking</P> Tue, 12 Dec 2017 10:10:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-subtract-one-date-from-another/m-p/335457#M99649 kamlesh_vaghela 2017-12-12T10:10:13Z