Compare/calculate with current date

[quadealexander]

Hi,

I want to create automatic obsolecance reports in Splunk. I grab the info from a database. There is a collum that has the obsolecance date in it.
Now I want to compare that date with the current date when the job is run and depending on how much time is left between them they get an obso_status (12 moths or less-> obso_satus 1 and so on). The dates look like this: 2012-11-30 00:00:00.0

Does someone has suggestions on how to do this?
thx in advance

[richgalloway]

This should get you started.

| dbxquery ... | eval obso_date=strptime(obsolecanceDate, "%Y-%m-%d %H:%M:%S.%N") | eval obso_status=case((obso_date-now()) < (86400*365), 1, <so on>) | ...

[gcusello · Accepted solution]

Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this

index=_internal | head 1 | eval diff=now()-_time | table _time diff

result is expressed in seconds.

If instead you want to compare a date with the current time, you have to transform it using the strptime function.

Bye.
Giuseppe