Splunk Search

How to create a new field with similar values?

beepbop
Explorer

Hi, I have a data with the following dates under the field "Warranty_End_Date"

Warranty_End_Date Manufacturer
4/1/2026 Lenovo
4/8/2026 Lenovo
1/9/2026 Acer
4/1/2025 Apple
19/7/2023 Acer
4/1/2026 Acer
4/4/2026 HP
8/1/2028 Lenovo
10/1/2022 Lenovo
4/1/2026 Apple
4/1/2026 Apple
4/1/2026 Lenovo
4/1/2026 Lenovo
4/1/2026 Lenovo
4/3/2026 Lenovo
4/3/2026 Lenovo


I want to create a new field with the similar values wrt Warranty_End_Date
Tried the command eval WarEnd = case("Warranty_End_Date" = "*2026", "2026", 1=1, "NA") and similarly for other years but got no proper output

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @beepbop,

let me understand, you want to create a new field, where id the year of "Warranty_End_Date" is 2026, you want to put 2026, otherwise "NA", is it correct?

if this is your requirement, you could try something like this:

| eval WarEnd=if(strftime(strptime("Warranty_End_Date","%d/%m/%Y"),"%Y")= "2026", "2026", "NA")

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @beepbop,

let me understand, you want to create a new field, where id the year of "Warranty_End_Date" is 2026, you want to put 2026, otherwise "NA", is it correct?

if this is your requirement, you could try something like this:

| eval WarEnd=if(strftime(strptime("Warranty_End_Date","%d/%m/%Y"),"%Y")= "2026", "2026", "NA")

Ciao.

Giuseppe

beepbop
Explorer

Yes,  the solution works, thanks @gcusello !

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...