Getting Data In

Subtract date from todays date to find status of the project

Communicator

Hello All, I am trying to injest into splunk a CSV which has a field called "Project End Date" and the field is in this format
11/7/2017 i.e dd/mm/yy. I am trying to find out how many days since the project is outstanding or how many days for the project to be completed.
ProjectTitle ProjectManager Task Start Date Task End Date Tasks Project Start Date Project End Date

Splunk Implementation user 2/2/2018 3/2/2018 Install os 2/2/2018 1/5/2018

Splunk Implementation user 2/2/2018 install universal forwarder in two linux 2/2/2018 1/5/2018

So basically i would need to subtract the project end date from the current date to see how many days the project is pending or how many days the project still have?
thanks

0 Karma
1 Solution

Super Champion

put the Project End Date into epoch and then use eval to subtract now() from it

something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)

View solution in original post

0 Karma

Super Champion

put the Project End Date into epoch and then use eval to subtract now() from it

something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)

View solution in original post

0 Karma

Communicator

absolute spot on. But during that time instead of now() i actually converted _time back to epoch and then followed the remaining step. But your answer is 100% correct.
Thanks

0 Karma