Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do you calculate the difference between two di...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

wagnerlucena

Explorer

10-30-2018
07:00 AM

HI all,

I've read many articles in Splunk community to find out how to calculate different dates. I get the correct result putting the date into the eval syntax but no success informing my fields into variables in eval syntax. Can anyone help me solve this problem?

My log is a JSON, I converted the date with strftime and strptime to get the format as "%d-%B-%y".

Follow below for my syntaxes, the first one is the one I'm working to solve and second one is the syntax that i got the correct result informing the date instead of field:

```
| rename fields.created as createdtime, key as Ticket, fields.updated as updatedtime
| eval created=strftime(strptime(createdtime,"%Y-%m-%dT%H:%M:%S.%3N"),"%d-%B-%y")
| eval last_time=strftime(strptime(updatedtime,"%Y-%m-%dT%H:%M:%S.%3N"),"%d-%B-%y")
| eval diff=(last_time-created) | eval diff = round(diff/60/60/24)
| search Ticket=ACSD-12754
| eventstats values(Ticket) as Ticket
| table Ticket,fields.status.name,diff,created, last_time
```

```
| eval created="26-October-18"
| eval triaged="29-October-18"
| eval dt_created=strptime(created, "%d-%B-%y") | eval last_date=strptime(triaged, "%d-%B-%y")
| eval diff=(last_date-dt_created)
| eval diff = round(diff/60/60/24)
| table created triaged diff | dedup created, triaged
```

1 Solution

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

renjith_nair

SplunkTrust

10-30-2018
07:11 AM

@wagnerlucena,

In your first search , calculate the difference in epoch (strptime) format before you convert it to string using strftime,

Try

```
| rename fields.created as createdtime, key as Ticket, fields.updated as updatedtime
| eval created=strptime(createdtime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval last_time=strptime(updatedtime,"%Y-%m-%dT%H:%M:%S.%3N")
| eval diff=(last_time-created) | eval diff = round(diff/60/60/24)
| search Ticket=ACSD-12754
| eventstats values(Ticket) as Ticket
| table Ticket,fields.status.name,diff,created, last_time *
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How do you calculate the difference between two different dates?

wagnerlucena

Explorer

10-30-2018
07:20 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How do you calculate the difference between two different dates?

renjith_nair

SplunkTrust

10-30-2018
07:28 AM

@wagnerlucena, that's because your created and last_time are multivalue field.

Try replacing the variables by

```
| eval created=strptime(mvindex(createdtime,0),"%Y-%m-%dT%H:%M:%S.%3N")
| eval last_time=strptime(mvindex(updatedtime,0),"%Y-%m-%dT%H:%M:%S.%3N")
```

Highlighted
##

Hi @renjith.nair you rock! Thanks for support, now i'm able get the difference. I'll adjust my query to retrieve the results that i'm looking for. Thanks again.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How do you calculate the difference between two different dates?

wagnerlucena

Explorer

10-30-2018
11:53 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How do you calculate the difference between two different dates?

renjith_nair

SplunkTrust

10-31-2018
04:26 AM

You are welcome. Glad that it worked. You may upvote the answer/comment if it's useful for others 🙂

Highlighted
##

can you please mention the final formula that you have used, I am looking for the same but not able to get the difference between two dates

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How do you calculate the difference between two different dates?

abhijitsaoji

Explorer

03-04-2019
10:51 PM