Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Calculate Age from 2 Timestamp fields

$
0
0
Hi All! I have a field in my data which represents DOB in a YYYYMMDD format. I'm trying to compare that DOB Timestamp with another Timestamp field which represents the time the event was created. Same format YYYYMMDD. What I'm trying to determine is how old someone is when they were tested. I've attempted to convert them both to epoch using eval, but it appears to only work on the first field. index=test | eval DOB = strftime(Date_of_Birth, "%Y%m%d") | eval ICD = strftime(Instance_Creation_Date, "%Y%m%d") | eval diff = ('DOB' - 'ICD') Anyone have a pointer? As always. Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>