Splunk Search

How do I add days taken from a field to a date field?

ZacEsa
Communicator

I have a field called "date"(2016-07-21) and a field called "countdown"(e.g. 30) which shows the number of days. How do I add the days to the date?

eval inputDate=strptime(date, "%Y-%m-%d") | eval expiring=relative_time(inputDate, "+30d@d") | eval expiring=strftime(expiring,"%Y-%m-%d")
0 Karma
1 Solution

javiergn
Super Champion

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

View solution in original post

ZacEsa
Communicator

I meant to put "+countdown@d" instead of "+30d@d"

0 Karma

javiergn
Super Champion

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

ZacEsa
Communicator

Works perfectly. Thanks! I was trying to find a Splunk feature that'll convert the days to epoch but, I wasn't thinking of just multiplying it. Haha.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...