Splunk Search

evaluate if date field dd/mm is older than 5 working days.

alfiyashaikh
New Member

I have case such as :

if date is older than 5 working (eg if today is Thursday 19th, then anything older than Thursday 12th), update the Feedback column with ‘resolution needs chase’

I have field extacted and converted by this code :

|eval testTime = strptime('VTN_field_2',"%d/%m")
|eval testTime2=(strftime('testTime',"%d/%m"))

which gives epoch date testTime :
e.g
1512498600.000000
1512498600.000000

and testTime2
e.g
01/12
06/12

Tags (2)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

I think this question is already answered here https://answers.splunk.com/answers/596221/convert-field-values-eg-1512-to-date-format-unders.html

Please let us know if this is different requirement.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Use that one (as just updated) and reverse the test.

0 Karma

alfiyashaikh
New Member

It is the same question, no different requirement .
here just "5 working days" is specified.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...