The easiest way is to use the strptime function provided by eval. When you use strptime it will parse the time into time_t-style units, meaning the # of seconds since 01 Jan 1970 00:00:00 GMT. From here, figuring out most (but not all) time mathematics is pretty easy. There's 86,400 units (seconds) per day, 3600 per hour, etc.
So, something like this:
| eval start_time_t=strptime("%m/%d/%Y",StartDate)
| eval end_time_t=strptime("%m/%d/%Y",EndDate)
| eval time_t_delta=end_time_t - start_time_t
| eval days_delta=time_t_delta / 86400
Now, this works really well until you get into non-uniform amounts of time - like months .. to deal with those, you'd probably need to define a custom search command and code it for yourself.
