Splunk Search

How do I add days taken from a field to a date field?

Communicator

I have a field called "date"(2016-07-21) and a field called "countdown"(e.g. 30) which shows the number of days. How do I add the days to the date?

eval inputDate=strptime(date, "%Y-%m-%d") | eval expiring=relative_time(inputDate, "+30d@d") | eval expiring=strftime(expiring,"%Y-%m-%d")
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

View solution in original post

Communicator

I meant to put "+countdown@d" instead of "+30d@d"

0 Karma

SplunkTrust
SplunkTrust

Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:

| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate  + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")

View solution in original post

Communicator

Works perfectly. Thanks! I was trying to find a Splunk feature that'll convert the days to epoch but, I wasn't thinking of just multiplying it. Haha.

0 Karma