https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420502#M191029 <P>Use creates date_mday and date_wday field for all index. Use can use these fields.<BR /> Below is an example using splunks internal index</P> <P>| tstats values(date_wday) as Day where index=_internal by date_mday <BR /> | rename date_mday as date <BR /> | sort date <BR /> | eval dayFlag = ( floor((date/7)) ) + 1 <BR /> | eval Message = date." is the ".dayFlag." ".Day." of the Month" <BR /> | table Message</P> Wed, 30 Sep 2020 01:33:08 GMT chinmoya 2020-09-30T01:33:08Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420501#M191028 <P>How can we apply below logic in splunk.</P> <P>We have the data in Splunk which is coming out as below.</P> <P>Host Patching Lot<BR /> A Lot 1<BR /> B Lot2<BR /> C Lot 3</P> <P>Lets say <BR /> Lot 1 means - First Sunday of Every Month<BR /> Lot 2 means - First Saturday of Every month<BR /> Lot 3 Means - Second Sunday of Every Month.</P> <P>How can we calculate the date corresponding to each lot for the current month.</P> <P>Required Output is </P> <P>Host Patching Lot Date<BR /> A Lot 1 4- Aug (First Sunday of Aug)<BR /> B Lot2 3- Aug (First Saturday of Aug)<BR /> C Lot 3 11- Aug (Second Sunday of Aug.)</P> <P>Thanks</P> Thu, 01 Aug 2019 09:26:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420501#M191028 sbhatnagar88 2019-08-01T09:26:10Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420502#M191029 <P>Use creates date_mday and date_wday field for all index. Use can use these fields.<BR /> Below is an example using splunks internal index</P> <P>| tstats values(date_wday) as Day where index=_internal by date_mday <BR /> | rename date_mday as date <BR /> | sort date <BR /> | eval dayFlag = ( floor((date/7)) ) + 1 <BR /> | eval Message = date." is the ".dayFlag." ".Day." of the Month" <BR /> | table Message</P> Wed, 30 Sep 2020 01:33:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420502#M191029 chinmoya 2020-09-30T01:33:08Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420503#M191030 <P>Hi Chinmoy,</P> <P>Thanks for Responding.</P> <P>Your logic seems correct, but I need this information in date format. can we do so?</P> <P>Thanks</P> Mon, 05 Aug 2019 08:43:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-date-based-upon-a-patch-lot-value/m-p/420503#M191030 sbhatnagar88 2019-08-05T08:43:49Z