please i will be glad to get answer to this query
| eval InT = if(((lastpickupdate + DaysOfARVRefil + 28) > IIT), "Interrupted", "Active")
"lastpickupdate" and "IIT" columns are in date format, whereas "DaysOfARVRefil" is in Days(int)
please how do i successfully run this query
thanks
osita
Hi @ositaumeozulu,
to make calculations between dates you have always to convert dates in epochtime,
I don't know what's the format of lastpickupdate and IIT, I suppose that it's "yyyy-mm-dd HH:MM:SS",
So you could run something like this:
| eval InT = if(((strptime(lastpickupdate,"%Y-%m-%d %H:%M:%S") + DaysOfARVRefil*86400 + 28*86400) > strptime(IIT,"%Y-%m-%d %H:%M:%S")), "Interrupted", "Active")
Ciao.
Giuseppe
Splunk cannot do much with dates in string format. They should be converted into integers using the strptime function first. Also, the number of days should be converted into seconds before it is added to a timestamp.
| eval lastpickupts = strptime(lastpickupdate, "<<format string>>")
| eval IITts = strptime(IIT, "<<format string>>")
| eval SecsOfARVRefil = (DaysOfARVRefil + 28) * 86400
| eval InT = if(((lastpickupts + SecsOfARVRefil ) > IITts), "Interrupted", "Active")
Hi @ositaumeozulu,
to make calculations between dates you have always to convert dates in epochtime,
I don't know what's the format of lastpickupdate and IIT, I suppose that it's "yyyy-mm-dd HH:MM:SS",
So you could run something like this:
| eval InT = if(((strptime(lastpickupdate,"%Y-%m-%d %H:%M:%S") + DaysOfARVRefil*86400 + 28*86400) > strptime(IIT,"%Y-%m-%d %H:%M:%S")), "Interrupted", "Active")
Ciao.
Giuseppe
Give this a try
| eval InT = if((strptime(lastpickupdate,"%Y-%m-%d") + (DaysOfARVRefil + 28)*86400) > strptime(IIT,"%Y-%m-%d"), "Interrupted", "Active")
(assuming both lastpickupdate and IIT has date in string and have format "%Y-%m-%d". If they are different, adjust the time format accordingly)