topic How to calculate dates in my search? in Splunk Search

How to calculate dates in my search?

ositaumeozulu — Mon, 06 Jun 2022 03:34:05 GMT

Sorry team to bother you again, i have a code that is giving me issues

| eval InT = (strptime('LastPickupDate',"%m-%d-%Y %H:%M:%S")) + (('DaysOfARVRefil'+ 28)*86400)

| stats list(InT) by FacilityName

but the column InT is all blank, again how do i convert InT back to readable date and list them by facility names

many thanks

osita

gcusello — Sat, 04 Jun 2022 06:31:25 GMT

to have the InT date you could also use reletive_time() function (https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions), nd anyway, you have to convert the epochtime of your calculation in Human Readable format.

something like this:

| eval InT = strftime(relative_time(strptime('LastPickupDate',"%m-%d-%Y %H:%M:%S"),"+28d"),"%m-%d-%Y %H:%M:%S")

Ciao.

Giuseppe

ositaumeozulu — Tue, 07 Jun 2022 13:06:47 GMT

@gcusello code not working, i keep getting blanks , i want to add days to a date and get my answer in date format