https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303164#M91219 <P>Why not convert your dates in epoch time (using eval or convert and mktime)<BR /> then convert your SLA in seconds, and add/subtract if from your dates<BR /> and at the end, convert back to a date (using eval/convert and ctime)</P> Thu, 22 Feb 2018 01:42:18 GMT yannK 2018-02-22T01:42:18Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303163#M91218 <P>Hello<BR /> What I am trying to do is calulate dates and span. <BR /> So I have a date called "Date Due" and a field "SLA". What I am trying to do is take "Date Due" and add "SLA" compare to the current date and give how many days past it currently is.</P> <P>Currently Im using this but the results arent spot on</P> <PRE><CODE>index=fp_dev_tsv "BO Type"="assessments" | rename "BO ID" as id| convert timeformat="%Y-%m-%d %H:%M:%S.%6N" mktime("Step Date Started") AS starttime mktime("Step Date Completed") AS endtime mktime("Step Due Date") AS cumulativeDueDate mktime("Step Actual Due Date") AS actualDueDate |eval dueDateRange=mvrange(actualDueDate,now(),86400) |convert ctime(dueDateRange) timeformat="%+" | eval pastDueDays =mvcount(mvfilter(NOT match(dueDateRange,"(Sun|Sat).*"))) </CODE></PRE> <P>this doesnt take into account the SLA field just counts the days from the actualDueDate until now in days. Its correct BUT I need to add in SLA and then compare<BR /> Heres a sample table:</P> <PRE><CODE>Name Past Due Step Name Past Due Step Due Date SLA for Past Due Step General Name Info 1 2018-02-01 20:38:10.154000 3 Genberal Name Info 2 2018-02-10 20:38:10.154000 10 General Name Info 3 2018-03-08 20:38:10.154000 5 General Name Info 4 2018-03-15 20:38:10.154000 5 General Name Info 5 2018-03-22 20:38:10.154000 5 </CODE></PRE> <P>So what I need to do is check each steps due date, add SLA and then compare to todays date.<BR /> Any idea how I can achieve this?</P> <P>Thanks for the help!</P> Wed, 21 Feb 2018 17:14:13 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303163#M91218 tkwaller_2 2018-02-21T17:14:13Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303164#M91219 <P>Why not convert your dates in epoch time (using eval or convert and mktime)<BR /> then convert your SLA in seconds, and add/subtract if from your dates<BR /> and at the end, convert back to a date (using eval/convert and ctime)</P> Thu, 22 Feb 2018 01:42:18 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303164#M91219 yannK 2018-02-22T01:42:18Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303165#M91220 <P>yep, thats exactly what I did, thanks!</P> Mon, 26 Feb 2018 15:11:57 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-calculate-date-and-time-span/m-p/303165#M91220 tkwaller_2 2018-02-26T15:11:57Z