https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604553#M13172 <LI-CODE lang="markup">| makeresults | eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02" | streamstats count as row | eval Holidays = split(Holidays,".") | mvexpand Holidays | eval Holidays = strftime(now(),"%Y / ").Holidays | eval Holidays = strptime(Holidays, "%Y / %m / %d") | stats values(*) as * by row | eval Holidays=mvjoin(Holidays,"|")</LI-CODE> Wed, 06 Jul 2022 09:46:18 GMT ITWhisperer 2022-07-06T09:46:18Z https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604552#M13171 <P>Hello everybody,<BR />I have a question for the community:<BR />Is there a reverse split command?</P><P>I'll explain my problem:<BR />I have a:<BR />| eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02"<BR />with the holidays that I want to remove from the day count<BR />(I create it, it can be a single value or a multivalue) now I have to add the current year:<BR />| eval year = strftime (now (), "% Y")<BR />and have this day excluded from the final count:<BR />| eval dates = mvrange (C3, now (), 86400)<BR />| eval dates = mvfilter (NOT match (dates, "(Excluded)"))<BR />| convert ctime (dates) timeformat = "% A"<BR />| eval dates = mvfilter (NOT match (dates, "(Saturday | Sunday)"))<BR />| eval noOfDays = mvcount (dates)</P><P>I want to create an Excluded field that has holidays with the current year as value for example:<BR />Excluded = "1640991600.000000 | 1641423600.00000 | 1660514400.000000 | ........"<BR />It's possible?<BR />Is there a reverse split command?<BR />Tks<BR />Br</P> Wed, 06 Jul 2022 09:43:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604552#M13171 antonio147 2022-07-06T09:43:18Z https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604553#M13172 <LI-CODE lang="markup">| makeresults | eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02" | streamstats count as row | eval Holidays = split(Holidays,".") | mvexpand Holidays | eval Holidays = strftime(now(),"%Y / ").Holidays | eval Holidays = strptime(Holidays, "%Y / %m / %d") | stats values(*) as * by row | eval Holidays=mvjoin(Holidays,"|")</LI-CODE> Wed, 06 Jul 2022 09:46:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604553#M13172 ITWhisperer 2022-07-06T09:46:18Z https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604555#M13173 <P>Hi ITWhisperer,<BR />thanks for the solution !!<BR />It works perfectly.<BR />Thank you so much</P> Wed, 06 Jul 2022 09:56:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-there-a-reverse-split-command/m-p/604555#M13173 antonio147 2022-07-06T09:56:23Z