Splunk Search

Convert years month days to Days

figuringthings
New Member

Hey,

Can anyone help me convert Age to Days? Have trouble parsing and calculating.

 

Sample Data

Age

2 years 3 months 2 days

3 months 4 days

2 days

 

I want to have a column with converted values to just days. Dont want exact days. Year could be 365 and month could be 30.

Age, d_age

2 years 3 months 2 days, 457

3 months 4 days, 94

2 days, 2

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="2 years 3 months 2 days
3 months 4 days
2 days"
| multikv noheader=t 
| fields _raw
| rex "(((?<years>\d+)\syears?\s)?(?<months>\d+)\smonths?\s)?(?<days>\d+)\sdays?"
| fillnull value=0
| eval d_age=(years * 365)+(months * 30)+days
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here is how

| makeresults
| eval Age=split("2 years 3 months 2 days,3 months 4 days,2 days", ",")
| mvexpand Age
| rex field=Age "((?<years>\d+)\s+years[^\d]*)?((?<months>\d+)\s+months[^\d]*)?((?<days>\d+)\s+days)?"
| fillnull years months days
| eval d_age=(years*365)+(months*30)+days
| table Age d_age years months days

I assume your 457 for the first was assuming 1 year...

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...