Getting Data In

## Substract two dates

Explorer

Hi all,

I am really struggling with subtracting  two dates from each other. It sounds that easy but drives me literally crazy.

All I want is, to subtract now() from a calculated date field.

``````| eval temp = relative_time(a, b)
| eval newdate = temp - now()``````

temp has a value of "1625634900.000000"

newdate will always be 01.01.1970. What am I missing?

Labels (1)
• ### time

Tags (1)
1 Solution
SplunkTrust

Hi @boo_com ,

the way is the one in my previous answer, but you can display a number that means the second remaining, but not a date!

Why did you used that way to convert a date in epochtime?

you could easily run something like this:

``````your_search
| eval date=strptime("06.07.2021","%d.%m.%Y")
| eval temp=relative_time(date,"1d@d+07h+15m")
| eval diff=temp-now()
| table diff``````

Ciao.

Giuseppe

Explorer

Hi guys!

Thank you for your quick response! So Giuseppe explained it very well. I want to get the difference between two dates. One date is calculated, the other date is just now(). I want something like a countdown, printed in a new field showing the time left.

``````| eval date = strptime(substr("06.07.2021",7,4)+"/"+substr("06.07.2021",4,2)+"/"+substr("06.07.2021",0,2), "%Y/%m/%d")
| eval offset = @d+1d+07h+15m
| eval temp = relative_time(date, offset)``````

date can be in the future or in the past.

How can I subtract temp from now() to receive the difference between those two dates?

SplunkTrust

Hi @boo_com ,

the way is the one in my previous answer, but you can display a number that means the second remaining, but not a date!

Why did you used that way to convert a date in epochtime?

you could easily run something like this:

``````your_search
| eval date=strptime("06.07.2021","%d.%m.%Y")
| eval temp=relative_time(date,"1d@d+07h+15m")
| eval diff=temp-now()
| table diff``````

Ciao.

Giuseppe

Explorer

nice, thank you so much! The difference is returned in seconds. That way I easily can calculate remaining minutes, hours and days!

Yes you are right, I do not need the "substr" function 🙂

Thanks again,

Peter

SplunkTrust

Hi @boo_com,

if you convert the result of the relative_time  you have "2021-07-07" (in other words tomorrow!).

Let me understand:

• "a" is a date,
• "b" id a time modifier (e.g. "-2d")
• you calculate a new date using relative time, that seems to be in the future,
• then you want to calculate the difference between the new date and now,

is it correct?

But in this way you haven't a date but a time difference between two dates, so it hasn't reason to display the difference in a date format.

Could you better describe your need?

Ciao.

Giuseppe

SplunkTrust

Can you please share more details about a and b fields ??

And why newdate will always be 01.01.1970. ?

KV

Get Updates on the Splunk Community!

#### Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

#### Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

#### We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...