Search
  • Todd Waller

Splunk - Quick Tip - Find number of days between date and now()


Hello Again Everyone!


Here’s something I ran into not that long ago. So I found the need to calculate the number of days between a day and now, now being the time I ran the search or when a report was run.


I have a field called "Step Due Date" formatted as "%Y-%m-%d %H:%M:%S.%6N"


Basically the Step Due Date is a date a step in a workflow is due. What I would like to do is find the number for days remaining between that date and today(when the report/search is run).


It’s a pretty easy few stanzas to get all of the data in the right format and calculated correctly. There may even be better ways to accomplish this but, for my needs this easily worked. Feel free to tweak the round function to be more exact, just an example:


| eval dateDue=strptime('Step Due Date', "%Y-%m-%d %H:%M:%S.%6N")| eval days = round((now()-dateDue)/86400)


Just a fun little exercise in quick calculations.


Thanks for the quick read!


-Todd







78 views0 comments

Recent Posts

See All

So I've been thinking today about how useful Splunk is on the "blue" side of the house. What about the Purple and Red side? What features would Splunk need to gain to add value to the other 2/3rds of