Splunk Search

How to normalize the dates and subtract them from each other to get elapsed time?

cotyp
Path Finder

Hello,

I am trying to normalize the dates on the below fields and subtract them from each other. How would I go about doing that? Is there a way that if there is no termination date, show something that says, Active and employed for X amount of time?

Thanks in advanced!
alt text

0 Karma

493669
Super Champion

Try like this:

|eval Terminates Date=if(isnull('Terminate Date'),strftime(now(),"%m/%d/%Y"),'Terminate Date') |eval Days=if(isnotnull('Terminate Date'),round((strptime('Terminate Date',"%m/%d/%Y"))-(strptime('Start Date',"%Y-%m-%d")))/86400,"Active and employeed for ".(round((strptime('Terminates Date',"%m/%d/%Y"))-(strptime('Start Date',"%Y-%m-%d")))/86400)." Days")
0 Karma

cotyp
Path Finder

nice! How would I make sure both the Terminate and Start date are shown in the same format? For instance XX-XX-XXXX?

0 Karma

493669
Super Champion

like this i.e. first converting time into epoch and then set format using strftime

...|eval Start Date=strftime(strptime('Start Date',"%Y-%m-%d"),"%m-%d-%Y"),
Terminate Date=strftime(strptime('Terminate Date',"%m/%d/%Y"),"%m-%d-%Y")
0 Karma

493669
Super Champion

please accept the answer if it resolves your query.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...