Splunk Search

Manipulating dates using splunk.

gpanicker
Explorer

Hi,

Are there any fuctions in Splunk which deal with Dates.I have to get the no: of days between startdate and end date.
2012-05-07 17:11:50,559 -.............. StartDate=06/03/2012, EndDate=06/04/2012
Please suggest the best way to do this.

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

The easiest way is to use the strptime function provided by eval. When you use strptime it will parse the time into time_t-style units, meaning the # of seconds since 01 Jan 1970 00:00:00 GMT. From here, figuring out most (but not all) time mathematics is pretty easy. There's 86,400 units (seconds) per day, 3600 per hour, etc.

So, something like this:

| eval start_time_t=strptime("%m/%d/%Y",StartDate)
| eval end_time_t=strptime("%m/%d/%Y",EndDate)
| eval time_t_delta=end_time_t - start_time_t
| eval days_delta=time_t_delta / 86400

Now, this works really well until you get into non-uniform amounts of time - like months .. to deal with those, you'd probably need to define a custom search command and code it for yourself.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...