Splunk Search

Difference between two dates

ncbshiva
Communicator

I have a log that has
Start date=2003-11-20 00:00:00,End date=2079-06-06 00:00:00.
I want to calculate the difference between the Enddate and Startdate, and display the difference in both days and in years.

Please help me

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

For days you can do this:

...  | eval days = round((strptime(Enddate, "%F %T") - strptime(Startdate, "%F %T")) / 86400)

For years it depends on what you want to see.

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...