$indexString$ sourcetype="hw_eox_v5" physicalType="$physical$" [| last_np_source("$indexString$", "hw_eox_v5")] $form.tech_filter_selection$ $GroupSubQuery$ | join deviceId type=left [ search $indexString$ sourcetype="devices" [| last_np_source("$indexString$ ", "devices")]|table productFamily deviceId ] | search productFamily="$product$" | eval Milestones=currentEoxMilestone.",".nextEoxMilestone
| makemv Milestones delim="," | mvexpand Milestones | eval Milestones=split(Milestones,",") | mvexpand Milestones | replace "SW_MAINTENANCE_RELEASE_DATE" with "EoSWM" in Milestones | replace "SALE_DATE" with "EoSale" in Milestones | replace "ROUTINE_FAILURE_ANALYSIS_DATE" with "EoRFA" in Milestones | replace "EO_SECURITY_VUL_SUPPORT_DATE" with "EoVSS" in Milestones | replace "SERVICE_CONTRACT_RENEWAL_DATE" with "EoSCR" in Milestones
| replace "SUPPORT_LAST_DATE" with "LDoS" in Milestones |search Milestones!=null
| replace Announced with "End Of Life Announcement" in Milestones
| replace EoRFA with "End of Routine Failure Analysis" in Milestones
| replace EoSWM with "End of Software Maintenance" in Milestones
| replace LDoS with "Last Date Of Support" in Milestones
| replace EoVSS with "End Of Security Vulneribility" in Milestones
| replace EoSale with "End Of Sale" in Milestones
| replace EoSCR with "End of Service Contract Renewal" in Milestones
|rex field=currentEoxMilestoneDate "(?<DATE>.)T." | rex field=nextEoxMilestoneDate "(?<DATE1>.)T." | eval NEWDATE1=DATE + ";" + DATE1 | fillnull value="null" DATE1 | fillnull value="null" NEWDATE1 | eval NEWDATE=DATE + ";" + DATE1 + ";" + NEWDATE1 | makemv delim=";" NEWDATE | mvexpand NEWDATE | where NEWDATE!="null" | eval ld=strptime(NEWDATE,"%Y-%m-%d")
| where ld < now() + (86400*$timer$) | where ld > now() - (86400*$timer1$) | eval EoxMilestoneDate=substr(NEWDATE,0,7) | rename EoxMilestoneDate as "Eox Milestone Date" | table "Eox Milestone Date", productFamily,Milestones
