Splunk Search

How can I perform a basic math operation between two fields?


I need to perform a subtraction between two date fields in order to get a specific age. How can I do this?

0 Karma


Use strptime to convert to epoch then subtract and convert to years.

<base search> | eval age=floor((strptime(date1, "%d/%m/%y") - strptime(date2, "%d/%m/%y"))/(86400*365))

Sample query:

| makeresults | eval date1="02/20/1993", date2="03/04/2020"| eval age=floor((strptime(date2, "%m/%d/%Y") - strptime(date1, "%m/%d/%Y"))/(86400*365))
0 Karma

Ultra Champion
yoursearch |eval age=(biggerValue - smallerValue)

Going out on a bit of a limb, and guessing what you might be trying:

<your search which gives you a field called dob>
|eval dobEpoch=strptime(dob, "%d/%m/%Y")
|eval ageSeconds=(now() - dobEpoch)
|eval age=strftime(ageSeconds, %y)
|fields - dobEpoch, ageSeconds
|table dob age

This assumes you have a search which returns a field called dob in the format "21/12/1980"
It converts that date to an epoch time - "dobEpoch"
Subtracts the dob (in epoch) from the current epoch time (now) and saves that in "ageSeconds"
does a conversion from seconds into years and saves that in "age"
removes the two unnecessary calculation fields
displays a table of DOB and Age

Or the same query, with fewer steps:

<your search which gives you a field called dob>
 |eval age=strftime((now() - strptime(dob, "%d/%m/%Y")), %y)
 |table dob age
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...