Archive
Highlighted

## How can I perform a basic math operation between two fields?

New Member

I need to perform a subtraction between two date fields in order to get a specific age. How can I do this?

Tags (3)
Highlighted

## Re: How can I perform a basic math operation between two fields?

Ultra Champion
``````yoursearch |eval age=(biggerValue - smallerValue)
``````

Going out on a bit of a limb, and guessing what you might be trying:

``````<your search which gives you a field called dob>
|eval dobEpoch=strptime(dob, "%d/%m/%Y")
|eval ageSeconds=(now() - dobEpoch)
|eval age=strftime(ageSeconds, %y)
|fields - dobEpoch, ageSeconds
|table dob age
``````

This assumes you have a search which returns a field called dob in the format "21/12/1980"
It converts that date to an epoch time - "dobEpoch"
Subtracts the dob (in epoch) from the current epoch time (now) and saves that in "ageSeconds"
does a conversion from seconds into years and saves that in "age"
removes the two unnecessary calculation fields
displays a table of DOB and Age

Or the same query, with fewer steps:

``````<your search which gives you a field called dob>
|eval age=strftime((now() - strptime(dob, "%d/%m/%Y")), %y)
|table dob age
``````
Highlighted

## Re: How can I perform a basic math operation between two fields?

Influencer

Use strptime to convert to epoch then subtract and convert to years.

``````<base search> | eval age=floor((strptime(date1, "%d/%m/%y") - strptime(date2, "%d/%m/%y"))/(86400*365))
``````

Sample query:

``````| makeresults | eval date1="02/20/1993", date2="03/04/2020"| eval age=floor((strptime(date2, "%m/%d/%Y") - strptime(date1, "%m/%d/%Y"))/(86400*365))
``````
Speak Up for Splunk Careers!