Getting Data In
Highlighted

Compare/calculate with current date

Explorer

Hi,

I want to create automatic obsolecance reports in Splunk. I grab the info from a database. There is a collum that has the obsolecance date in it.
Now I want to compare that date with the current date when the job is run and depending on how much time is left between them they get an obsostatus (12 moths or less-> obsosatus 1 and so on). The dates look like this: 2012-11-30 00:00:00.0

Does someone has suggestions on how to do this?
thx in advance

0 Karma
Highlighted

Re: Compare/calculate with current date

Legend

Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this

index=_internal | head 1 | eval diff=now()-_time | table _time diff

result is expressed in seconds.

If instead you want to compare a date with the current time, you have to transform it using the strptime function.

Bye.
Giuseppe

View solution in original post

Highlighted

Re: Compare/calculate with current date

SplunkTrust
SplunkTrust

This should get you started.

| dbxquery ... | eval obso_date=strptime(obsolecanceDate, "%Y-%m-%d %H:%M:%S.%N") | eval obso_status=case((obso_date-now()) < (86400*365), 1, <so on>) | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma