Ongoing Patching Countdown

[stevenbo]

Hello everyone, I am trying to use Splunk to create an ongoing patching countdown that will be Single Value (Days Until Patch) on my Dashboard. How can I go about accomplishing this? I was able to calculate 1 patch cycle, but I am not sure how to get it to recalculate for every month. Right now for example, it is telling me the next patch date is 2/29/2024. Hoping someone already has a solution built out. Thank you for any assistance! 

This is what I have so far:

| makeresults
| eval start= strptime("02-01-2024", "%m-%d-%Y")
| eval startStr=strftime(start, "%D")
| eval PatchDate = relative_time(start ,"+28d")
| eval PatchDateString= strftime(PatchDate, "%D")
| eval PriorPatchDate = relative_time(start ,"-28d")
| eval PriorPatchDateString = strftime(PriorPatchDate, "%D")
| eval daysCountD= strftime(PatchDate - now(), "%d")
| table daysCountD PriorPatchDateString PatchDateString

[burwell]

Hi so what's the patching schedule? Every 28 days starting in Feb 1?

[stevenbo]

---

@burwell wrote:

Hi so what's the patching schedule? Every 28 days starting in Feb 1?

---

Sorry, yes. Every 28 days starting Feb 1. 

[burwell · Accepted solution]

How about something like this

| makeresults
| eval start= strptime("02-01-2024", "%m-%d-%Y")
| eval today=now()
| eval time_difference=floor((today-start)/(60*60*24))
| eval mod_val=time_difference % 28
| eval days_to_patch=28-mod_val

[stevenbo]

---

@burwell wrote:

How about something like this

| makeresults
| eval start= strptime("02-01-2024", "%m-%d-%Y")
| eval today=now()
| eval time_difference=floor((today-start)/(60*60*24))
| eval mod_val=time_difference % 28
| eval days_to_patch=28-mod_val

---

Thank you, I think this does exactly what I need! Greatly appreciated! 

[burwell]

Glad to hear this is what you needed. 

You can accept this solution to indicate the question was answered to your liking.  thanks!