Splunk Search

Date Calculation (Negative Display)

willadams
Contributor

I have a query where in I am subtracting 2 dates from the current time.  While my query works, I have noted that if the difference is 2 days in the past then this is reflected as a positive number in my table.  For example:

I have the following records

expiry_daterequest_id
05/08/20211234
05/08/20214567
01/08/20218901
30/08/20212345

 

My query is 

 

 

|inputlookup mycurrentrequests.csv
| eval requests_past=round(abs((now()-strptime('expiry_date', "%d/%m/%Y")))/86400,0)
| where requests_past > 1 AND requests_past < 30

 

 

 

The search will run, however what I will now see in my view is

expiry_daterequest_idrequests_past
05/08/202112342
05/08/202145672
01/08/202189012
30/08/2021234527

 

For the expiry_date of 01/08/2021 this is in the past so technically "2" is correct but I want this to be presented as "-2".  

 

I will then use this to effectively do a "where requests_past is <0" as well as a "where requests_past is > 0" 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)
0 Karma

willadams
Contributor

Thanks. For this particular instance absolute function should not be being used. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...