Splunk Search

How to calculate date and int columns?

ositaumeozulu
Explorer

please i will be glad to get answer to this query

| eval  InT = if(((lastpickupdate + DaysOfARVRefil  + 28) > IIT), "Interrupted", "Active")

"lastpickupdate" and "IIT" columns are in date format, whereas "DaysOfARVRefil" is in Days(int)

please how do i successfully run this query 

thanks

osita

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ositaumeozulu,

to make calculations between dates you have always to convert dates in epochtime,

I don't know what's the format of lastpickupdate and IIT, I suppose that it's "yyyy-mm-dd HH:MM:SS",

So you could run something like this:

| eval  InT = if(((strptime(lastpickupdate,"%Y-%m-%d %H:%M:%S") + DaysOfARVRefil*86400  + 28*86400) > strptime(IIT,"%Y-%m-%d %H:%M:%S")), "Interrupted", "Active")

Ciao.

Giuseppe

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk cannot do much with dates in string format.  They should be converted into integers using the strptime function first.  Also, the number of days should be converted into seconds before it is added to a timestamp.

| eval lastpickupts = strptime(lastpickupdate, "<<format string>>")
| eval IITts = strptime(IIT, "<<format string>>")
| eval SecsOfARVRefil = (DaysOfARVRefil + 28) * 86400
| eval  InT = if(((lastpickupts + SecsOfARVRefil ) > IITts), "Interrupted", "Active")
---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ositaumeozulu,

to make calculations between dates you have always to convert dates in epochtime,

I don't know what's the format of lastpickupdate and IIT, I suppose that it's "yyyy-mm-dd HH:MM:SS",

So you could run something like this:

| eval  InT = if(((strptime(lastpickupdate,"%Y-%m-%d %H:%M:%S") + DaysOfARVRefil*86400  + 28*86400) > strptime(IIT,"%Y-%m-%d %H:%M:%S")), "Interrupted", "Active")

Ciao.

Giuseppe

somesoni2
Revered Legend

Give this a try

| eval  InT = if((strptime(lastpickupdate,"%Y-%m-%d") + (DaysOfARVRefil  + 28)*86400) > strptime(IIT,"%Y-%m-%d"), "Interrupted", "Active")

 (assuming both lastpickupdate and IIT has date in string  and have format  "%Y-%m-%d". If they are different, adjust the time format accordingly)

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...