Splunk Search

How to calculate total month difference between dates?

Builder

Can you please tell us, how to calculate total month difference between dates?

Example:

startDate=1/1/2013 00:00:00
endDate=current date

Month difference count = 36

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try something like this

| gentimes start=-1 | eval startDate=strptime("1/1/2013 00:00:00","%m/%d/%Y %H:%M:%S") | table startDate  | eval endDate=now() | eval sametimethisyear=strptime(strftime(startDate,"%m/%d/").strftime(endDate,"%Y"),"%m/%d/%Y") | eval diffMonth=if(endDate>sametimethisyear,12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) + (tonumber(strftime(endDate,"%m"))-tonumber(strftime(sametimethisyear,"%m"))),12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) - (tonumber(strftime(sametimethisyear,"%m"))-tonumber(strftime(endDate,"%m"))))

View solution in original post

SplunkTrust
SplunkTrust

Try something like this

| gentimes start=-1 | eval startDate=strptime("1/1/2013 00:00:00","%m/%d/%Y %H:%M:%S") | table startDate  | eval endDate=now() | eval sametimethisyear=strptime(strftime(startDate,"%m/%d/").strftime(endDate,"%Y"),"%m/%d/%Y") | eval diffMonth=if(endDate>sametimethisyear,12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) + (tonumber(strftime(endDate,"%m"))-tonumber(strftime(sametimethisyear,"%m"))),12*(tonumber(strftime(sametimethisyear,"%Y"))-tonumber(strftime(startDate,"%Y"))) - (tonumber(strftime(sametimethisyear,"%m"))-tonumber(strftime(endDate,"%m"))))

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!