https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510894#M143079 <P>I have a report which runs every week on Monday , I'm using earliest and latest time in my search .&nbsp; Now I wanted to add a new field to my search called lastdate say if a report period is between 07/01 to 07/07 the lastdate field should display 07/07 and For my monthly report how do I create new field called MonthEnd and this&nbsp; should displays the values as June 30 for month ending date, Please help</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 24 Jul 2020 20:03:42 GMT iamsplunker 2020-07-24T20:03:42Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510894#M143079 <P>I have a report which runs every week on Monday , I'm using earliest and latest time in my search .&nbsp; Now I wanted to add a new field to my search called lastdate say if a report period is between 07/01 to 07/07 the lastdate field should display 07/07 and For my monthly report how do I create new field called MonthEnd and this&nbsp; should displays the values as June 30 for month ending date, Please help</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 24 Jul 2020 20:03:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510894#M143079 iamsplunker 2020-07-24T20:03:42Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510897#M143080 <LI-CODE lang="markup">earliest="07/01/2020:00:00:00" latest="07/07/2020:23:59:59" index=_internal | head 1 | addinfo | eval lastdate=strftime(info_max_time,"%F") | eval MonthEnd=strftime(relative_time(info_min_time,"@month-1d"),"%F") | table lastdate MonthEnd</LI-CODE> Fri, 24 Jul 2020 20:24:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510897#M143080 to4kawa 2020-07-24T20:24:49Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510898#M143081 <P>Hi</P><P>add to your stats</P><P>&nbsp;</P><LI-CODE lang="java">| stats .... latest(_time) as lastDay range(_time) AS dateRange .... | eval lastDayOfMonth = strftime (lastDay, "%B %d"), lastDay = strftime (lastDay, "%d/%m"), reportPeriod = if (dateRange &gt; 604800, "Monthly", "Weekly") ....</LI-CODE><P>&nbsp;</P><P>and then use those fields lastDay and lastDayOfMonth.</P><P>r. Ismo</P> Mon, 27 Jul 2020 15:25:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/510898#M143081 isoutamo 2020-07-27T15:25:11Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511140#M143164 <P>Thanks Sautamo the lastday field works just fine. But I also want to add a field called Report Period the value should represent the Week/Month depending on the granularity of the report.&nbsp;</P> Mon, 27 Jul 2020 14:58:37 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511140#M143164 iamsplunker 2020-07-27T14:58:37Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511152#M143169 <P>Hi</P><P>I updated my previous answer by adding reportPeriod.</P><P>r. Ismo</P> Mon, 27 Jul 2020 15:26:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511152#M143169 isoutamo 2020-07-27T15:26:02Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511196#M143186 <P>Thanks soutamo. I accepted your answer. I hope this is the last comment in this thread. Can you please explain about&nbsp; the value you've mentioned&nbsp; 604800 . For both date ranges 6/1 -6/7 and 6/1-6/30 it is showing the Granularity as Weekly. for 6/1-6/30 it should show as Monthly. Thanks for all your help</P> Mon, 27 Jul 2020 18:04:14 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511196#M143186 iamsplunker 2020-07-27T18:04:14Z https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511203#M143189 <P>It is seven days in seconds. Current stats needs that there are events (_time) for start and end date/time. Of course you could use those from your given start and end dates where this would works even there haven’t been any events.&nbsp;<BR />r. Ismo</P> Mon, 27 Jul 2020 18:47:19 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-create-new-field-with-last-day-of-reporting-period-to/m-p/511203#M143189 isoutamo 2020-07-27T18:47:19Z