Splunk Search

## calculate the days between 2 dates

Motivator

this is my search:

``````| makeresults count=2 |
eval start=relative_time(now(),"@d") |
eval start_string=strftime(start,"%Y-%m-%d") |
eval end=strptime("1 jan 2017","%d %b %Y") |
eval end_string=strftime(end,"%Y-%m-%d") |
eval start_minus_end=end-start/1400
``````

give s me the following:

``````_time   end end_string  start   start_minus_end start_string
1   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20
2   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20
``````

How do I work out how many days are between `start_string` and `end_string`?
I have tried to do this with `eval start_minus_end=end-start/1400` but i am not sure what value `start_string` is? is it milliseconds?

As an aside I would then like to store this value in a variable that I can somehow use in the `predict` function and assign it to `future_timespan` e.g. `predict kpi1 as kpi1 future_timespan=<VARIABLE> holdback=1`

Tags (4)
Champion

Splunk also has a tostring function that allows you to, among other things, convert seconds to a duration. The result is in the format of days+HH:MM:SS

``````| eval duration = tostring(end - start,"duration")
``````

So in your case the result for today is 257+01:00:00.000000

Legend

Hi HattrickNZ,

epoch is time in seconds so replace the last eval with this:

`````` eval start_minus_end=round((end-start)/86400,0)
``````

and you will get the numbers of days.
This is the result:

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

#### 2024 Splunk Career Impact Survey | Earn a \$20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

#### Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

#### What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...