Splunk Search

## How to calculate date and int columns?

Explorer

| eval  InT = if(((lastpickupdate + DaysOfARVRefil  + 28) > IIT), "Interrupted", "Active")

"lastpickupdate" and "IIT" columns are in date format, whereas "DaysOfARVRefil" is in Days(int)

please how do i successfully run this query

thanks

osita

Labels (1)
• ### eval

Tags (1)
1 Solution
SplunkTrust

to make calculations between dates you have always to convert dates in epochtime,

I don't know what's the format of lastpickupdate and IIT, I suppose that it's "yyyy-mm-dd HH:MM:SS",

So you could run something like this:

``| eval  InT = if(((strptime(lastpickupdate,"%Y-%m-%d %H:%M:%S") + DaysOfARVRefil*86400  + 28*86400) > strptime(IIT,"%Y-%m-%d %H:%M:%S")), "Interrupted", "Active")``

Ciao.

Giuseppe

SplunkTrust

Splunk cannot do much with dates in string format.  They should be converted into integers using the strptime function first.  Also, the number of days should be converted into seconds before it is added to a timestamp.

``````| eval lastpickupts = strptime(lastpickupdate, "<<format string>>")
| eval IITts = strptime(IIT, "<<format string>>")
| eval SecsOfARVRefil = (DaysOfARVRefil + 28) * 86400
| eval  InT = if(((lastpickupts + SecsOfARVRefil ) > IITts), "Interrupted", "Active")``````
---
If this reply helps you, Karma would be appreciated.
SplunkTrust

to make calculations between dates you have always to convert dates in epochtime,

I don't know what's the format of lastpickupdate and IIT, I suppose that it's "yyyy-mm-dd HH:MM:SS",

So you could run something like this:

``| eval  InT = if(((strptime(lastpickupdate,"%Y-%m-%d %H:%M:%S") + DaysOfARVRefil*86400  + 28*86400) > strptime(IIT,"%Y-%m-%d %H:%M:%S")), "Interrupted", "Active")``

Ciao.

Giuseppe

Revered Legend

Give this a try

``| eval  InT = if((strptime(lastpickupdate,"%Y-%m-%d") + (DaysOfARVRefil  + 28)*86400) > strptime(IIT,"%Y-%m-%d"), "Interrupted", "Active")``

(assuming both lastpickupdate and IIT has date in string  and have format  "%Y-%m-%d". If they are different, adjust the time format accordingly)

Get Updates on the Splunk Community!

#### Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

#### Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...