How to merge two field values into one?

[jenniferleenyc]

I'm trying to compare two date values, Valid_Till(ex: Oct 7 12:58:21 2016) and the current_date(ex: 08/01/16). In order to create a consistent format, I want to convert Valid_Till to numeric values so that it matches current_date's format. What would be the best way to do this? I've tried using strptime, but it didn't work out.

[MuS]

Hi jenniferleenyc,

take this run everywhere search :

| gentimes start=-1
| eval foo1="Oct 7 12:58:21 2016", foo2="08/01/16" 
| eval boo1=strptime(foo1, "%b %e %H:%M:%S %Y"), boo2=strptime(foo2, "%m/%d/%y") 
| table foo1 foo2 boo1 boo2

This will create some dummy fields and using strptime you will parse the values of foo1 and foo2 into epoch values which later can be compared. See the docs on strptime http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions#Date_and_Time_...

 This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y.

For more information on the time format option see http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Commontimeformatvariables

Hope this helps ...

cheers, MuS

[pradeepkumarg]

What was the search you tried?

Something like below should work

 | eval Valid_Till_epoch = strptime(Valid_Till, "%b %d %H:%M:%S %Y") 

[sundareshr]

Try this run anywhere sample. This converts the Valid_Till & current_date format to epoch time

| gentimes start=-1 | eval x="Oct 7 12:58:21 2016" | eval y=strptime(x, "%b %-d %H:%M:%S %Y") | eval a="08/01/16" | eval b=strptime(a, "%m/%d/%y") | table x y a b