How to calculate date based upon a patch lot value.

[sbhatnagar88]

How can we apply below logic in splunk.

We have the data in Splunk which is coming out as below.

Host Patching Lot
A Lot 1
B Lot2
C Lot 3

Lets say
Lot 1 means - First Sunday of Every Month
Lot 2 means - First Saturday of Every month
Lot 3 Means - Second Sunday of Every Month.

How can we calculate the date corresponding to each lot for the current month.

Required Output is

Host Patching Lot Date
A Lot 1 4- Aug (First Sunday of Aug)
B Lot2 3- Aug (First Saturday of Aug)
C Lot 3 11- Aug (Second Sunday of Aug.)

Thanks

[sbhatnagar88]

Hi Chinmoy,

Thanks for Responding.

Your logic seems correct, but I need this information in date format. can we do so?

Thanks

[chinmoya]

Use creates date_mday and date_wday field for all index. Use can use these fields.
Below is an example using splunks internal index

| tstats values(date_wday) as Day where index=_internal by date_mday
| rename date_mday as date
| sort date
| eval dayFlag = ( floor((date/7)) ) + 1
| eval Message = date." is the ".dayFlag." ".Day." of the Month"
| table Message