Getting Data In

Subtract date from todays date to find status of the project

ranjitbrhm1
Communicator

Hello All, I am trying to injest into splunk a CSV which has a field called "Project End Date" and the field is in this format
11/7/2017 i.e dd/mm/yy. I am trying to find out how many days since the project is outstanding or how many days for the project to be completed.
Project_Title Project_Manager Task Start Date Task End Date Tasks Project Start Date Project End Date

Splunk Implementation user 2/2/2018 3/2/2018 Install os 2/2/2018 1/5/2018

Splunk Implementation user 2/2/2018 install universal forwarder in two linux 2/2/2018 1/5/2018

So basically i would need to subtract the project end date from the current date to see how many days the project is pending or how many days the project still have?
thanks

0 Karma
1 Solution

cmerriman
Super Champion

put the Project End Date into epoch and then use eval to subtract now() from it

something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)

View solution in original post

0 Karma

cmerriman
Super Champion

put the Project End Date into epoch and then use eval to subtract now() from it

something like this should work:
|rename "Project End Date" as project_end_date|eval project_end_epoch=strptime(project_end_date,"%d/%m/%Y")|eval days_left=round((project_end_epoch-now())/86400,0)

0 Karma

ranjitbrhm1
Communicator

absolute spot on. But during that time instead of now() i actually converted _time back to epoch and then followed the remaining step. But your answer is 100% correct.
Thanks

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...