Splunk Search

Date Calculation (Negative Display)

willadams
Contributor

I have a query where in I am subtracting 2 dates from the current time.  While my query works, I have noted that if the difference is 2 days in the past then this is reflected as a positive number in my table.  For example:

I have the following records

expiry_daterequest_id
05/08/20211234
05/08/20214567
01/08/20218901
30/08/20212345

 

My query is 

 

 

|inputlookup mycurrentrequests.csv
| eval requests_past=round(abs((now()-strptime('expiry_date', "%d/%m/%Y")))/86400,0)
| where requests_past > 1 AND requests_past < 30

 

 

 

The search will run, however what I will now see in my view is

expiry_daterequest_idrequests_past
05/08/202112342
05/08/202145672
01/08/202189012
30/08/2021234527

 

For the expiry_date of 01/08/2021 this is in the past so technically "2" is correct but I want this to be presented as "-2".  

 

I will then use this to effectively do a "where requests_past is <0" as well as a "where requests_past is > 0" 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is the abs function which is changing -2 to 2 - try without it

| eval requests_past=round((now()-strptime('expiry_date', "%d/%m/%Y"))/86400,0)
0 Karma

willadams
Contributor

Thanks. For this particular instance absolute function should not be being used. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...