Archive
Highlighted

How can I perform a basic math operation between two fields?

New Member

I need to perform a subtraction between two date fields in order to get a specific age. How can I do this?

0 Karma
Highlighted

Re: How can I perform a basic math operation between two fields?

Ultra Champion
yoursearch |eval age=(biggerValue - smallerValue)

Going out on a bit of a limb, and guessing what you might be trying:

<your search which gives you a field called dob>
|eval dobEpoch=strptime(dob, "%d/%m/%Y")
|eval ageSeconds=(now() - dobEpoch)
|eval age=strftime(ageSeconds, %y)
|fields - dobEpoch, ageSeconds
|table dob age

This assumes you have a search which returns a field called dob in the format "21/12/1980"
It converts that date to an epoch time - "dobEpoch"
Subtracts the dob (in epoch) from the current epoch time (now) and saves that in "ageSeconds"
does a conversion from seconds into years and saves that in "age"
removes the two unnecessary calculation fields
displays a table of DOB and Age

Or the same query, with fewer steps:

<your search which gives you a field called dob>
 |eval age=strftime((now() - strptime(dob, "%d/%m/%Y")), %y)
 |table dob age
0 Karma
Highlighted

Re: How can I perform a basic math operation between two fields?

Influencer

Use strptime to convert to epoch then subtract and convert to years.

<base search> | eval age=floor((strptime(date1, "%d/%m/%y") - strptime(date2, "%d/%m/%y"))/(86400*365))

Sample query:

| makeresults | eval date1="02/20/1993", date2="03/04/2020"| eval age=floor((strptime(date2, "%m/%d/%Y") - strptime(date1, "%m/%d/%Y"))/(86400*365))
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.