Splunk Search

Manipulating dates using splunk.

gpanicker
Explorer

Hi,

Are there any fuctions in Splunk which deal with Dates.I have to get the no: of days between startdate and end date.
2012-05-07 17:11:50,559 -.............. StartDate=06/03/2012, EndDate=06/04/2012
Please suggest the best way to do this.

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

The easiest way is to use the strptime function provided by eval. When you use strptime it will parse the time into time_t-style units, meaning the # of seconds since 01 Jan 1970 00:00:00 GMT. From here, figuring out most (but not all) time mathematics is pretty easy. There's 86,400 units (seconds) per day, 3600 per hour, etc.

So, something like this:

| eval start_time_t=strptime("%m/%d/%Y",StartDate)
| eval end_time_t=strptime("%m/%d/%Y",EndDate)
| eval time_t_delta=end_time_t - start_time_t
| eval days_delta=time_t_delta / 86400

Now, this works really well until you get into non-uniform amounts of time - like months .. to deal with those, you'd probably need to define a custom search command and code it for yourself.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...