https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215196#M63073 <P>Hi.</P> <P>I have a monitor of "/etc/shadow" file with last password change field <STRONG>lastchange</STRONG> in days (example lastchange=16937). It's a number of days from 01/01/1970<BR /> I need to determine the date of last password change of a user.<BR /> I want to do something like: <CODE>01.01.1970+lastchange=last_password_change_date</CODE><BR /> How to do that?</P> Tue, 21 Jun 2016 10:53:23 GMT kalianov 2016-06-21T10:53:23Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215196#M63073 <P>Hi.</P> <P>I have a monitor of "/etc/shadow" file with last password change field <STRONG>lastchange</STRONG> in days (example lastchange=16937). It's a number of days from 01/01/1970<BR /> I need to determine the date of last password change of a user.<BR /> I want to do something like: <CODE>01.01.1970+lastchange=last_password_change_date</CODE><BR /> How to do that?</P> Tue, 21 Jun 2016 10:53:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215196#M63073 kalianov 2016-06-21T10:53:23Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215197#M63074 <P>There are 86400 seconds per day. "Epoch time" is seconds since 1/1/1970 GMT. Therefore you want to multiply days since 1/1/1970 by 86400. </P> <PRE><CODE>... eval epochTime=lastchange*86400 ... </CODE></PRE> <P>Once you have epoch time you can use "convert ctime(epochTime)" to change to human readable dates like this:</P> <PRE><CODE>... | eval epochTime=lastchange*86400 | convert ctime(epochTime) |... </CODE></PRE> Tue, 21 Jun 2016 11:08:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215197#M63074 jkat54 2016-06-21T11:08:12Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215198#M63075 <P>Thanks a lot. It's working</P> Tue, 21 Jun 2016 11:31:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215198#M63075 kalianov 2016-06-21T11:31:48Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215199#M63076 <P>Anytime! Thanks for marking as your answer!</P> Tue, 21 Jun 2016 11:34:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215199#M63076 jkat54 2016-06-21T11:34:55Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215200#M63077 <P>@jkat54 , could you please help me on this, I have filed which contains number of days, i,e. <STRONG>days=20098</STRONG> i,e 2020 jan 1st onwards. 98 days means April 7th 2020 like that. i need to convert these numbers to date.</P> Thu, 09 Apr 2020 05:28:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215200#M63077 james_n 2020-04-09T05:28:22Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215201#M63078 <PRE><CODE>| makeresults | eval days=20098 | eval days_hr=strptime(days,"%y%j") | eval check = strftime(days_hr,"%c") </CODE></PRE> <P>@james_n try this.</P> Thu, 09 Apr 2020 08:27:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-field-containing-number-of-days-since-01-01/m-p/215201#M63078 to4kawa 2020-04-09T08:27:21Z