Splunk Search

Date Calculation (Negative Display)

willadams
Contributor

I have a query where in I am subtracting 2 dates from the current time.  While my query works, I have noted that if the difference is 2 days in the past then this is reflected as a positive number in my table.  For example:

I have the following records

expiry_daterequest_id
05/08/20211234
05/08/20214567
01/08/20218901
30/08/20212345

 

My query is 

 

 

|inputlookup mycurrentrequests.csv
| eval requests_past=round(abs((now()-strptime('expiry_date', "%d/%m/%Y")))/86400,0)
| where requests_past > 1 AND requests_past < 30

 

 

 

The search will run, however what I will now see in my view is

expiry_daterequest_idrequests_past
05/08/202112342
05/08/202145672
01/08/202189012
30/08/2021234527

 

For the expiry_date of 01/08/2021 this is in the past so technically "2" is correct but I want this to be presented as "-2".  

 

I will then use this to effectively do a "where requests_past is <0" as well as a "where requests_past is > 0" 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)
0 Karma

willadams
Contributor

Thanks. For this particular instance absolute function should not be being used. 

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...