How can I sum several dates that are in a single field?

[franciscof]

I need to sum several dates that are on a single field to then divide it with another field to get an average date. Do you have any clues?

[gcusello · Accepted solution]

Hi @franciscof,
you have to:

• divide the field in different events using the mvexpand command ( https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Mvexpand ),
• convert the field in epochtime using strptime option in eval command,
• execute the operation you need using eval.

Ciao.
Giuseppe