Date difference in months

[vinihei_987]

on my search

index=raw_fe5_autsust Aplicacao=HUB Endpoint="*/"
| eval RefUser=if(Mes!="", Mes, substr("0" + tostring((tonumber(strftime(_time, "%m"))-1)), -2) + "-" + strftime(_time, "%Y"))
| eval RefUser = strptime(RefUser,"%Y/%m")
| eval RefAtual = relative_time(-time, "-1mon")

I need to get the difference between RefUser and RefAtual in months and count by this diff

[marnall]

One thing to note is that the strptime does not work with just a month and year, it needs a day value as well. ref: https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions

If the RegUser string has only a year and month, you could format it to include the day 01. E.g.

| eval RefUser = RefUser+"/01"
| eval RefUser = strptime(RefUser,"%Y/%m/%d")

For the RefAtual, I assume you are taking 1 month earlier than the current _time value:

| eval RefAtual = relative_time(_time, "-1mon")

Once you have these two timestamps in unixtime format, then you can take the absolute difference between them, and divide by the number of seconds in a month (assuming 30 days in a month, that is 60*60*24*30). Then set the number of digits to round to

| eval months_between = abs(RefAtual - refUser) / (60*60*24*30)
| eval months_between = round(months_between,1)