Manipulating dates using splunk.

[gpanicker]

Hi,

Are there any fuctions in Splunk which deal with Dates.I have to get the no: of days between startdate and end date.
2012-05-07 17:11:50,559 -.............. StartDate=06/03/2012, EndDate=06/04/2012
Please suggest the best way to do this.

[dwaddle]

The easiest way is to use the strptime function provided by eval. When you use strptime it will parse the time into time_t-style units, meaning the # of seconds since 01 Jan 1970 00:00:00 GMT. From here, figuring out most (but not all) time mathematics is pretty easy. There's 86,400 units (seconds) per day, 3600 per hour, etc.

So, something like this:

| eval start_time_t=strptime("%m/%d/%Y",StartDate)
| eval end_time_t=strptime("%m/%d/%Y",EndDate)
| eval time_t_delta=end_time_t - start_time_t
| eval days_delta=time_t_delta / 86400

Now, this works really well until you get into non-uniform amounts of time - like months .. to deal with those, you'd probably need to define a custom search command and code it for yourself.