How to calculate days between 2 dates?

[splunkuser320]

Hi, Not sure what the issue is. I got the solution from the other answers, but it's not working for me.

I am getting data from splunk date picker and trying to calculate the number of days. 

|addinfo | eval min=info_min_time, max=info_max_time
| eval earliest =strftime(min,"%Y-%m-%d %H:%M:%S")
| eval latest=strftime(max,"%Y-%m-%d %H:%M:%S")
| eval duration = round((latest-earliest)/86400)
|table latest, earliest, duration

Thanks

[richgalloway]

The main problem is latest and earliest are strings (the output of strftime()) so it makes no sense to substract them.  The calculation of duration, therefore, results in NULL.  The fix is to use min and max to compute duration.

Also, addinfo is not a generating command so it cannot be the first command in a query.

| makeresults 
| addinfo 
| eval min=info_min_time+10, max=info_max_time 
| eval earliest =strftime(min,"%Y-%m-%d %H:%M:%S") 
| eval latest=strftime(max,"%Y-%m-%d %H:%M:%S") 
| eval duration = round((max-min)/86400) 
| table latest, earliest, duration