topic Re: How do I add days taken from a field to a date field? in Splunk Search

How do I add days taken from a field to a date field?

ZacEsa — Thu, 21 Jul 2016 08:02:54 GMT

I have a field called "date"(2016-07-21) and a field called "countdown"(e.g. 30) which shows the number of days. How do I add the days to the date?

eval inputDate=strptime(date, "%Y-%m-%d") | eval expiring=relative_time(inputDate, "+30d@d") | eval expiring=strftime(expiring,"%Y-%m-%d")

javiergn — Thu, 21 Jul 2016 08:20:28 GMT

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

ZacEsa — Thu, 21 Jul 2016 08:32:34 GMT

Works perfectly. Thanks! I was trying to find a Splunk feature that'll convert the days to epoch but, I wasn't thinking of just multiplying it. Haha.

ZacEsa — Thu, 21 Jul 2016 08:34:38 GMT

I meant to put "+countdown@d" instead of "+30d@d"