Splunk Search

Not able to get number of days between now() and a date

sbhatnagar88
Path Finder

Hi Experts,

I am trying to get number of days between current date and another date being generated by my query and I am using the below code to calculate the same but i am getting blank results.

| rex field=current "(?P\d{4}-\d{2}-\d{2})" -->date value fetched from field named "current". output for "date" field is 2018-09-01
| eval days = round((now()-date)/86400,0)
| table days.

Please suggest where I am wrong.

Labels (2)
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval date="2018-09-01" 
| eval dateDue=strptime(date, "%Y-%m-%d") 
| eval days = round((now()-dateDue)/86400)

View solution in original post

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval date="2018-09-01" 
| eval dateDue=strptime(date, "%Y-%m-%d") 
| eval days = round((now()-dateDue)/86400)

sbhatnagar88
Path Finder

Thanks..working perfectly fine..

0 Karma

jsnyderlmco
Engager

I have been working on something similar and was a about to ask a question to the group until I found this answer. It solved one of the missing puzzle pieces for me. Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...