Splunk Search

Date Calculation (Negative Display)

willadams
Contributor

I have a query where in I am subtracting 2 dates from the current time.  While my query works, I have noted that if the difference is 2 days in the past then this is reflected as a positive number in my table.  For example:

I have the following records

expiry_daterequest_id
05/08/20211234
05/08/20214567
01/08/20218901
30/08/20212345

 

My query is 

 

 

|inputlookup mycurrentrequests.csv
| eval requests_past=round(abs((now()-strptime('expiry_date', "%d/%m/%Y")))/86400,0)
| where requests_past > 1 AND requests_past < 30

 

 

 

The search will run, however what I will now see in my view is

expiry_daterequest_idrequests_past
05/08/202112342
05/08/202145672
01/08/202189012
30/08/2021234527

 

For the expiry_date of 01/08/2021 this is in the past so technically "2" is correct but I want this to be presented as "-2".  

 

I will then use this to effectively do a "where requests_past is <0" as well as a "where requests_past is > 0" 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)
0 Karma

willadams
Contributor

Thanks. For this particular instance absolute function should not be being used. 

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...