How to subtract one date from another?

[eranday]

I hold a list of two dates that I want to subtract one from another
these dates are an outcome from:
|convert timeformat="%Y-%m-%d" ctime(_time) AS date1

source:
| date1 | date2 |
|2017-12-08 | 2017-12-05 |
|2017-12-04 | 2017-12-05 |
|2017-12-05 | 2017-12-05 |

Wanted outcom:
| date 1 | date 2 | diff |
|2017-12-08 | 2017-12-05 | 3 |
|2017-12-04 | 2017-12-05 | 1 |
|2017-12-05 | 2017-12-05 | 0 |

[sbbadri]

@eranday

Please try below,

| makeresults | eval d1="2017-12-08" | eval d2="2017-12-05" | eval da1=strptime(d1,"%Y-%m-%d") | eval da2=strptime(d2,"%Y-%m-%d") | eval diff=da1-da2 | eval diff=strftime(diff,"%d")

[niketn]

@eranday, please try the following runanywhere search,

| makeresults
| eval date2=relative_time(_time,"-3d")
| eval date1=strftime(_time,"%Y%m%d")
| eval date2=strftime(date2,"%Y%m%d")
| eval diff=date1-date2

You can replace first two pipes with your query to get date1 and date2 as epoch time. I have used relative_time function to get dummy data which is 3 days prior i.e. -3d.

[kamlesh_vaghela · Accepted solution]

Hi @eranday,

Can you please try this search?

YOUR_SEARCH
| eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400)
| eval diff=mvcount(dates)

My Sample Search:

| makeresults 
| eval date1="2017-12-08" , date2="2017-12-05" 
| eval dates=mvrange(strptime(date2,"%Y-%m-%d"),strptime(date1,"%Y-%m-%d"),86400)
| eval diff=mvcount(dates)

Thanks

[eranday]

not working

[kamlesh_vaghela]

search updated pls try it.

[eranday]

Champ!! it works
Thanks

[kamlesh_vaghela]

Great.. !!

Can you please accept the answer to close this question?

Thanks
Happy Splunking