topic how to calculate -90 day and - 1 day if i pass date from time picker dynamically ? in Splunk Search

how to calculate -90 day and - 1 day if i pass date from time picker dynamically ?

shankarananthth — Fri, 27 May 2016 18:30:10 GMT

kindly some one help pls.

For the above question i use this approch.

... | eval early_date=""$timeinv.earliest$""    
| eval yest1 = relative_time(""$timeinv.earliest$"", "-1d@d" )  
| eval days90_ago1 = relative_time(""$timeinv.earliest$"", "-90d@d" )  
| eval yest=strftime(yest1, "%Y-%m-%d")    
| eval days90_ago=strftime(days90_ago1, "%Y-%m-%d") 
| eval R_recon_business_date=substr(recon_business_date,1,10)

Is there any-other approach to achieve it. above mentioned approach is very slow.

Thanks in advance.

Re: how to calculate -90 day and - 1 day if i pass date from time picker dynamically ?

somesoni2 — Fri, 27 May 2016 18:56:36 GMT

Are you trying to add few columns (yest and days90_ago) into your search OR just generating those values to be displayed ?? Could you provide you full search so that we can know the context?

Re: how to calculate -90 day and - 1 day if i pass date from time picker dynamically ?

shankarananthth — Tue, 29 Sep 2020 09:49:37 GMT

im trying to generate a date colume -90 days and -1 day with the dynamic value passed from time picker . later i will use those two date fields in filter again like same provide below.

| where R_recon_business_date >= days90_ago AND R_recon_business_date <= yest

Thanks in advance..

This is the sample query framed ..

index=data_for_checkprod

| rename currency_val as currency_code

| join type=left currency_code [search index=currenciesss]

| eval a= (-txn_amount/100)

| eval start_date="1464235200"

| eval day_bef = relative_time("1464235200", "-1d@d" )

| eval 90days_ago = relative_time("1464235200", "-90d@d" )

| eval yesterday=strftime(day_bef, "%Y-%m-%d")

| eval ago_90days=strftime(90days_ago, "%Y-%m-%d")
| eval R_re_bis_date=substr(recon_business_date,1,10)
| where R_re_bis_date >= ago_90days AND R_re_bis_date <= yesterday
| where (like(ID, "FI72%") OR like(ID, "FI80%") OR msg ="0200" OR msg ="0420" OR tran_type = "01" )
AND pos_origin="true"

| stats sum(a) as show_data by R_re_bis_date, ID, code
| table R_re_bis_date ,ID,code,show_data

Re: how to calculate -90 day and - 1 day if i pass date from time picker dynamically ?

woodcock — Fri, 27 May 2016 20:04:12 GMT

If your answer gives you what you need (only you can say), then that is all there is to it. There is no quicker way to do what you have shown. Furthermore, there should be nothing "slow" about it.