HI all,
I've read many articles in Splunk community to find out how to calculate different dates. I get the correct result putting the date into the eval syntax but no success informing my fields into variables in eval syntax. Can anyone help me solve this problem?
My log is a JSON, I converted the date with strftime and strptime to get the format as "%d-%B-%y".
Follow below for my syntaxes, the first one is the one I'm working to solve and second one is the syntax that i got the correct result informing the date instead of field:
| rename fields.created as createdtime, key as Ticket, fields.updated as updatedtime
| eval created=strftime(strptime(createdtime,"%Y-%m-%dT%H:%M:%S.%3N"),"%d-%B-%y")
| eval last_time=strftime(strptime(updatedtime,"%Y-%m-%dT%H:%M:%S.%3N"),"%d-%B-%y")
| eval diff=(last_time-created) | eval diff = round(diff/60/60/24)
| search Ticket=ACSD-12754
| eventstats values(Ticket) as Ticket
| table Ticket,fields.status.name,diff,created, last_time
| eval created="26-October-18"
| eval triaged="29-October-18"
| eval dt_created=strptime(created, "%d-%B-%y") | eval last_date=strptime(triaged, "%d-%B-%y")
| eval diff=(last_date-dt_created)
| eval diff = round(diff/60/60/24)
| table created triaged diff | dedup created, triaged
... View more