Splunk Search

## How to calculate total month difference between dates?

Builder

Can you please tell us, how to calculate total month difference between dates?

Example:

startDate=1/1/2013 00:00:00
endDate=current date

Month difference count = 36

Tags (5)
1 Solution
Revered Legend

Try something like this

``````| gentimes start=-1 | eval startDate=strptime("1/1/2013 00:00:00","%m/%d/%Y %H:%M:%S") | table startDate  | eval endDate=now() | eval sametimethisyear=strptime(strftime(startDate,"%m/%d/").strftime(endDate,"%Y"),"%m/%d/%Y") | eval diffMonth=if(endDate>sametimethisyear,12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) + (tonumber(strftime(endDate,"%m"))-tonumber(strftime(sametimethisyear,"%m"))),12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) - (tonumber(strftime(sametimethisyear,"%m"))-tonumber(strftime(endDate,"%m"))))
``````
Revered Legend

Try something like this

``````| gentimes start=-1 | eval startDate=strptime("1/1/2013 00:00:00","%m/%d/%Y %H:%M:%S") | table startDate  | eval endDate=now() | eval sametimethisyear=strptime(strftime(startDate,"%m/%d/").strftime(endDate,"%Y"),"%m/%d/%Y") | eval diffMonth=if(endDate>sametimethisyear,12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) + (tonumber(strftime(endDate,"%m"))-tonumber(strftime(sametimethisyear,"%m"))),12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) - (tonumber(strftime(sametimethisyear,"%m"))-tonumber(strftime(endDate,"%m"))))
``````
State of Splunk Careers