Splunk Search

Is there a way to determine days between with this search?

jhayIV
Engager

Is there a way to determine days between with the search below?

convert ctime(LastScanDate)|eval tnow = now() | convert ctime(tnow)|eval NoOfDays=(now()-Install)/(3600*24)
Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

If your Install value is in epoch already, this will give you number of day between today and date represented by install.

.....| eval NoOfDays=(relative_time(now(),"@d")-relative_time(Install,"@d"))/86400

If it's not epoch already, convert it to epoch

.....| eval NoOfDays=(relative_time(now(),"@d")-relative_time(strptime(Install,"<<TIMEFORMATHERE>>"),"@d"))/86400

Where, TIMEFORMATHERE is the exact time format of the date in the field Install. See this for more details on the format https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

View solution in original post

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@jhayIV - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If your Install value is in epoch already, this will give you number of day between today and date represented by install.

.....| eval NoOfDays=(relative_time(now(),"@d")-relative_time(Install,"@d"))/86400

If it's not epoch already, convert it to epoch

.....| eval NoOfDays=(relative_time(now(),"@d")-relative_time(strptime(Install,"<<TIMEFORMATHERE>>"),"@d"))/86400

Where, TIMEFORMATHERE is the exact time format of the date in the field Install. See this for more details on the format https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...