Splunk Search

Date Calculation (Negative Display)

willadams
Contributor

I have a query where in I am subtracting 2 dates from the current time.  While my query works, I have noted that if the difference is 2 days in the past then this is reflected as a positive number in my table.  For example:

I have the following records

expiry_daterequest_id
05/08/20211234
05/08/20214567
01/08/20218901
30/08/20212345

 

My query is 

 

 

|inputlookup mycurrentrequests.csv
| eval requests_past=round(abs((now()-strptime('expiry_date', "%d/%m/%Y")))/86400,0)
| where requests_past > 1 AND requests_past < 30

 

 

 

The search will run, however what I will now see in my view is

expiry_daterequest_idrequests_past
05/08/202112342
05/08/202145672
01/08/202189012
30/08/2021234527

 

For the expiry_date of 01/08/2021 this is in the past so technically "2" is correct but I want this to be presented as "-2".  

 

I will then use this to effectively do a "where requests_past is <0" as well as a "where requests_past is > 0" 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)
0 Karma

willadams
Contributor

Thanks. For this particular instance absolute function should not be being used. 

0 Karma