Splunk Search

## How can I perform a basic math operation between two fields?

Explorer

I need to perform a subtraction between two date fields in order to get a specific age. How can I do this?

Tags (3)
SplunkTrust

Use strptime to convert to epoch then subtract and convert to years.

``````<base search> | eval age=floor((strptime(date1, "%d/%m/%y") - strptime(date2, "%d/%m/%y"))/(86400*365))
``````

Sample query:

``````| makeresults | eval date1="02/20/1993", date2="03/04/2020"| eval age=floor((strptime(date2, "%m/%d/%Y") - strptime(date1, "%m/%d/%Y"))/(86400*365))
``````
Ultra Champion
``````yoursearch |eval age=(biggerValue - smallerValue)
``````

Going out on a bit of a limb, and guessing what you might be trying:

``````<your search which gives you a field called dob>
|eval dobEpoch=strptime(dob, "%d/%m/%Y")
|eval ageSeconds=(now() - dobEpoch)
|eval age=strftime(ageSeconds, %y)
|fields - dobEpoch, ageSeconds
|table dob age
``````

This assumes you have a search which returns a field called dob in the format "21/12/1980"
It converts that date to an epoch time - "dobEpoch"
Subtracts the dob (in epoch) from the current epoch time (now) and saves that in "ageSeconds"
does a conversion from seconds into years and saves that in "age"
removes the two unnecessary calculation fields
displays a table of DOB and Age

Or the same query, with fewer steps:

``````<your search which gives you a field called dob>
|eval age=strftime((now() - strptime(dob, "%d/%m/%Y")), %y)
|table dob age
``````
If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

#### Observability Highlights | January 2023 Newsletter

January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

#### Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

#### Platform Highlights | January 2023 Newsletter

January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...