Perform an eval "strptime" on both dates, or a convert with timeformat, then simply use another eval to do the subtraction.
Something like this from this answer (http://splunk-base.splunk.com/answers/10021/delta-between-two-date-data-fields):
...| convert timeformat='%m-%d-%Y %T' mktime(starttime) mktime(endtime) | eval duration=(endtime-starttime)/86400
There are quite a few different ways to do it. If you search for "splunk difference between two dates", or "splunk subtracting two dates" or similar, you should get quite a few answers to your question.
