Splunk Search

In a table using CSV data, how do we add "waitdays" to date and show in new column ?

ibob0304
Communicator

I have CSV data like below,

---------------------------------------------------
Date1              |   WaitDays   
---------------------------------------------------
9/24/2018      | 20
8/28/2018      | 160
7/13/2018      | 01

How do we add the waitdays to date and show in new column ?

 | eval inputDate = relative_time(Date1, "%Y-%m-%d")
 | eval expiring = inputDate  + WaitDays
 | eval expiring = strftime(expiring, "%Y-%m-%d")

I tried this, but it is not working as expected.

0 Karma
1 Solution

Vijeta
Influencer

Hi,

You can use the below logic for date and waitdays conversion to seconds and then calculating exp date

eval date=strptime(Date1,"%m/%d/%Y")| eval wdays= WaitDays * 60 *24 * 60|eval exp= date + wdays| eval exp=strftime(exp,"%Y/%m/%d")

Thanks
Vijeta

View solution in original post

Vijeta
Influencer

Hi,

You can use the below logic for date and waitdays conversion to seconds and then calculating exp date

eval date=strptime(Date1,"%m/%d/%Y")| eval wdays= WaitDays * 60 *24 * 60|eval exp= date + wdays| eval exp=strftime(exp,"%Y/%m/%d")

Thanks
Vijeta

ibob0304
Communicator

Tried 60*24*60 and it worked.,

0 Karma

Vijeta
Influencer

yes sorry missed the * while typing

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...