Splunk Search

Not able to get number of days between now() and a date

sbhatnagar88
Path Finder

Hi Experts,

I am trying to get number of days between current date and another date being generated by my query and I am using the below code to calculate the same but i am getting blank results.

| rex field=current "(?P\d{4}-\d{2}-\d{2})" -->date value fetched from field named "current". output for "date" field is 2018-09-01
| eval days = round((now()-date)/86400,0)
| table days.

Please suggest where I am wrong.

Labels (2)
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval date="2018-09-01" 
| eval dateDue=strptime(date, "%Y-%m-%d") 
| eval days = round((now()-dateDue)/86400)

View solution in original post

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval date="2018-09-01" 
| eval dateDue=strptime(date, "%Y-%m-%d") 
| eval days = round((now()-dateDue)/86400)

sbhatnagar88
Path Finder

Thanks..working perfectly fine..

0 Karma

jsnyderlmco
Engager

I have been working on something similar and was a about to ask a question to the group until I found this answer. It solved one of the missing puzzle pieces for me. Thank you!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...