Splunk Search

calculate the days between 2 dates

HattrickNZ
Motivator

this is my search:

| makeresults count=2 | 
eval start=relative_time(now(),"@d") | 
eval start_string=strftime(start,"%Y-%m-%d") | 
eval end=strptime("1 jan 2017","%d %b %Y") | 
eval end_string=strftime(end,"%Y-%m-%d") | 
eval start_minus_end=end-start/1400

give s me the following:

_time   end end_string  start   start_minus_end start_string
1   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20
2   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20

How do I work out how many days are between start_string and end_string?
I have tried to do this with eval start_minus_end=end-start/1400 but i am not sure what value start_string is? is it milliseconds?

As an aside I would then like to store this value in a variable that I can somehow use in the predict function and assign it to future_timespan e.g. predict kpi1 as kpi1 future_timespan=<VARIABLE> holdback=1

Tags (4)
0 Karma

maciep
Champion

Splunk also has a tostring function that allows you to, among other things, convert seconds to a duration. The result is in the format of days+HH:MM:SS

| eval duration = tostring(end - start,"duration")

So in your case the result for today is 257+01:00:00.000000

0 Karma

MuS
Legend

Hi HattrickNZ,

epoch is time in seconds so replace the last eval with this:

 eval start_minus_end=round((end-start)/86400,0)

and you will get the numbers of days.
This is the result:

alt text
Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...