<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to convert the value into months , days in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702556#M238202</link>
    <description>&lt;P&gt;Hi Mus&amp;nbsp;&lt;BR /&gt;Thanks for help&lt;/P&gt;&lt;P&gt;However when i run the query i am getting an error message&amp;nbsp;&lt;BR /&gt;&lt;SPAN&gt;Error in 'makeresults' command: This command must be the first command of a search.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaibalaraman_0-1729654254028.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/33187iF4ABDEFFF556B941/image-size/medium?v=v2&amp;amp;px=400" role="button" title="jaibalaraman_0-1729654254028.png" alt="jaibalaraman_0-1729654254028.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
    <pubDate>Wed, 23 Oct 2024 03:31:00 GMT</pubDate>
    <dc:creator>jaibalaraman</dc:creator>
    <dc:date>2024-10-23T03:31:00Z</dc:date>
    <item>
      <title>How to convert the value into months , days</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702546#M238198</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I am building dashboard for UPS monitoring and i would like to convert a specific metric which is battery age.&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Which give us some information about last battery changed however i would like to see the result in month , days like below&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Expected outcome&lt;/STRONG&gt; - 1 month 20 days.&lt;/P&gt;
&lt;P&gt;current outcome&amp;nbsp; below image&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaibalaraman_0-1729637560233.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/33185iE7835C4F09FE7B0B/image-size/medium?v=v2&amp;amp;px=400" role="button" title="jaibalaraman_0-1729637560233.png" alt="jaibalaraman_0-1729637560233.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Spl query&lt;/STRONG&gt; -&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index="ups" indexed_is_service_aggregate=1 kpi=BatteryAge| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title AS service_name | search service_name="MainUPS" |stats latest(alert_value) AS BatteryAge&lt;/LI-CODE&gt;
&lt;P&gt;Can anyone help me on this&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2024 00:01:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702546#M238198</guid>
      <dc:creator>jaibalaraman</dc:creator>
      <dc:date>2024-10-23T00:01:55Z</dc:date>
    </item>
    <item>
      <title>Re: How to convert the value into months , days</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702554#M238201</link>
      <description>&lt;P&gt;Hi there,&lt;/P&gt;&lt;P&gt;try this :&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval alert_value=1060, BatteryAge=strftime(alert_value, "%m months %d days")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;this will return:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MuS_0-1729653964375.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/33186iA2CD65A2FBA28E76/image-size/medium?v=v2&amp;amp;px=400" role="button" title="MuS_0-1729653964375.png" alt="MuS_0-1729653964375.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;but not sure you then can use it in a single value panel. Just give it a try.&lt;/P&gt;&lt;P&gt;Hope this helps ...&lt;/P&gt;&lt;P&gt;Cheers, MuS&lt;/P&gt;&lt;P&gt;Update:&lt;/P&gt;&lt;P&gt;This is based on the simple assumption every month has 4 weeks, because I'm not a mathematician nor scientist &lt;span class="lia-unicode-emoji" title=":winking_face:"&gt;😉&lt;/span&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval alert_value=1060, secs=alert_value*86400, months=round(secs/604800), days=round(alert_value - ((secs- (secs/604800)) / 60 /60 /24)) , alert_value = months ." months ". days ." days"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2024 20:46:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702554#M238201</guid>
      <dc:creator>MuS</dc:creator>
      <dc:date>2024-10-23T20:46:54Z</dc:date>
    </item>
    <item>
      <title>Re: How to convert the value into months , days</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702556#M238202</link>
      <description>&lt;P&gt;Hi Mus&amp;nbsp;&lt;BR /&gt;Thanks for help&lt;/P&gt;&lt;P&gt;However when i run the query i am getting an error message&amp;nbsp;&lt;BR /&gt;&lt;SPAN&gt;Error in 'makeresults' command: This command must be the first command of a search.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaibalaraman_0-1729654254028.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/33187iF4ABDEFFF556B941/image-size/medium?v=v2&amp;amp;px=400" role="button" title="jaibalaraman_0-1729654254028.png" alt="jaibalaraman_0-1729654254028.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2024 03:31:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702556#M238202</guid>
      <dc:creator>jaibalaraman</dc:creator>
      <dc:date>2024-10-23T03:31:00Z</dc:date>
    </item>
    <item>
      <title>Re: How to convert the value into months , days</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702557#M238203</link>
      <description>&lt;P&gt;Just noticed that will not work &lt;span class="lia-unicode-emoji" title=":face_with_rolling_eyes:"&gt;🙄&lt;/span&gt; will ned some loop hooping to get months and then days ....&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2024 03:36:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702557#M238203</guid>
      <dc:creator>MuS</dc:creator>
      <dc:date>2024-10-23T03:36:05Z</dc:date>
    </item>
    <item>
      <title>Re: How to convert the value into months , days</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702558#M238204</link>
      <description>&lt;P&gt;ah yes, this example needs to run on its own and will create sample events. but see my other reply this needs more logic&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2024 03:37:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702558#M238204</guid>
      <dc:creator>MuS</dc:creator>
      <dc:date>2024-10-23T03:37:18Z</dc:date>
    </item>
    <item>
      <title>Re: How to convert the value into months , days</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702577#M238214</link>
      <description>&lt;P&gt;What unit of time is your BatteryAge in, seconds, hours, days?&lt;/P&gt;&lt;P&gt;How long is a month?&lt;/P&gt;&lt;P&gt;If your current day is the 5th of the month and the age equates to 40 days, what result would you expect?&lt;/P&gt;</description>
      <pubDate>Wed, 23 Oct 2024 08:12:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-convert-the-value-into-months-days/m-p/702577#M238214</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-10-23T08:12:55Z</dc:date>
    </item>
  </channel>
</rss>

