Splunk Search

calculate the days between 2 dates

HattrickNZ
Motivator

this is my search:

| makeresults count=2 | 
eval start=relative_time(now(),"@d") | 
eval start_string=strftime(start,"%Y-%m-%d") | 
eval end=strptime("1 jan 2017","%d %b %Y") | 
eval end_string=strftime(end,"%Y-%m-%d") | 
eval start_minus_end=end-start/1400

give s me the following:

_time   end end_string  start   start_minus_end start_string
1   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20
2   2016-04-20 10:13:02 1483182000.000000   2017-01-01  1461067200.000000   1482138380.571429   2016-04-20

How do I work out how many days are between start_string and end_string?
I have tried to do this with eval start_minus_end=end-start/1400 but i am not sure what value start_string is? is it milliseconds?

As an aside I would then like to store this value in a variable that I can somehow use in the predict function and assign it to future_timespan e.g. predict kpi1 as kpi1 future_timespan=<VARIABLE> holdback=1

Tags (4)
0 Karma

maciep
Champion

Splunk also has a tostring function that allows you to, among other things, convert seconds to a duration. The result is in the format of days+HH:MM:SS

| eval duration = tostring(end - start,"duration")

So in your case the result for today is 257+01:00:00.000000

0 Karma

MuS
Legend

Hi HattrickNZ,

epoch is time in seconds so replace the last eval with this:

 eval start_minus_end=round((end-start)/86400,0)

and you will get the numbers of days.
This is the result:

alt text
Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...