Splunk Search

How do I add days taken from a field to a date field?

ZacEsa
Communicator

I have a field called "date"(2016-07-21) and a field called "countdown"(e.g. 30) which shows the number of days. How do I add the days to the date?

eval inputDate=strptime(date, "%Y-%m-%d") | eval expiring=relative_time(inputDate, "+30d@d") | eval expiring=strftime(expiring,"%Y-%m-%d")
0 Karma
1 Solution

javiergn
Super Champion

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

View solution in original post

ZacEsa
Communicator

I meant to put "+countdown@d" instead of "+30d@d"

0 Karma

javiergn
Super Champion

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

ZacEsa
Communicator

Works perfectly. Thanks! I was trying to find a Splunk feature that'll convert the days to epoch but, I wasn't thinking of just multiplying it. Haha.

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...