How can I perform a basic math operation between two fields?

[franciscof]

I need to perform a subtraction between two date fields in order to get a specific age. How can I do this?

[manjunathmeti]

Use strptime to convert to epoch then subtract and convert to years.

<base search> | eval age=floor((strptime(date1, "%d/%m/%y") - strptime(date2, "%d/%m/%y"))/(86400*365))

Sample query:

| makeresults | eval date1="02/20/1993", date2="03/04/2020"| eval age=floor((strptime(date2, "%m/%d/%Y") - strptime(date1, "%m/%d/%Y"))/(86400*365))

[nickhills]

yoursearch |eval age=(biggerValue - smallerValue)

Going out on a bit of a limb, and guessing what you might be trying:

<your search which gives you a field called dob>
|eval dobEpoch=strptime(dob, "%d/%m/%Y")
|eval ageSeconds=(now() - dobEpoch)
|eval age=strftime(ageSeconds, %y)
|fields - dobEpoch, ageSeconds
|table dob age

This assumes you have a search which returns a field called dob in the format "21/12/1980"
It converts that date to an epoch time - "dobEpoch"
Subtracts the dob (in epoch) from the current epoch time (now) and saves that in "ageSeconds"
does a conversion from seconds into years and saves that in "age"
removes the two unnecessary calculation fields
displays a table of DOB and Age

Or the same query, with fewer steps:

<your search which gives you a field called dob>
 |eval age=strftime((now() - strptime(dob, "%d/%m/%Y")), %y)
 |table dob age