topic Re: How to merge two field values into one? in Splunk Search

How to merge two field values into one?

jenniferleenyc — Tue, 29 Sep 2020 10:27:03 GMT

I'm trying to compare two date values, Valid_Till(ex: Oct 7 12:58:21 2016) and the current_date(ex: 08/01/16). In order to create a consistent format, I want to convert Valid_Till to numeric values so that it matches current_date's format. What would be the best way to do this? I've tried using strptime, but it didn't work out.

Re: How to merge two field values into one?

sundareshr — Tue, 29 Sep 2020 10:29:50 GMT

Try this run anywhere sample. This converts the Valid_Till & current_date format to epoch time

| gentimes start=-1 | eval x="Oct 7 12:58:21 2016" | eval y=strptime(x, "%b %-d %H:%M:%S %Y") | eval a="08/01/16" | eval b=strptime(a, "%m/%d/%y") | table x y a b

Re: How to merge two field values into one?

pradeepkumarg — Mon, 01 Aug 2016 20:25:07 GMT

What was the search you tried?

Something like below should work

 | eval Valid_Till_epoch = strptime(Valid_Till, "%b %d %H:%M:%S %Y")

Re: How to merge two field values into one?

MuS — Mon, 01 Aug 2016 20:32:25 GMT

Hi jenniferleenyc,

take this run everywhere search :

| gentimes start=-1
| eval foo1="Oct 7 12:58:21 2016", foo2="08/01/16" 
| eval boo1=strptime(foo1, "%b %e %H:%M:%S %Y"), boo2=strptime(foo2, "%m/%d/%y") 
| table foo1 foo2 boo1 boo2

This will create some dummy fields and using strptime you will parse the values of foo1 and foo2 into epoch values which later can be compared. See the docs on strptime http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions#Date_and_Time_functions

 This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y.

For more information on the time format option see http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Commontimeformatvariables

Hope this helps ...

cheers, MuS