...| eval start = strptime(date1, "%Y-%m-%d %H:%M:%S")| eval end = strptime(date2, "%Y-%m-%d %H:%M:%S")| eval duration = round((end-start)/86400)
Converts column to timestamp(epoc): strptime(field, date_format)
This will give you the duration in days (example): 23
source="dmon-tail://idhouse/id_account" application=TFD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d@d"), "%Y/%m/%d %H:%M")
This query is working good .
I need one more help ,
I want to count the days between exp_date and today date
any one can help me on this ...
Thank u ,
i need to generate a time based report. Below are the inputs
Start Date : string
End Date : string
I need the no of days from ( now to startDate) and (now to endDate), so that i can play around.
This is not working....
Here is my scenario... I have event coming in SPLUNK from database and i have 2 date columns in it. I need to get the difference between the 2 days and want to filter all records that are greater than 30 days.