how to calculate -90 day and - 1 day if i pass date from time picker dynamically ?

[shankarananthth]

kindly some one help pls.

For the above question i use this approch.

... | eval early_date=""$timeinv.earliest$""    
| eval yest1 = relative_time(""$timeinv.earliest$"", "-1d@d" )  
| eval days90_ago1 = relative_time(""$timeinv.earliest$"", "-90d@d" )  
| eval yest=strftime(yest1, "%Y-%m-%d")    
| eval days90_ago=strftime(days90_ago1, "%Y-%m-%d") 
| eval R_recon_business_date=substr(recon_business_date,1,10)

Is there any-other approach to achieve it. above mentioned approach is very slow.

Thanks in advance.

[woodcock]

If your answer gives you what you need (only you can say), then that is all there is to it. There is no quicker way to do what you have shown. Furthermore, there should be nothing "slow" about it.

[somesoni2]

Are you trying to add few columns (yest and days90_ago) into your search OR just generating those values to be displayed ?? Could you provide you full search so that we can know the context?

[shankarananthth]

im trying to generate a date colume -90 days and -1 day with the dynamic value passed from time picker . later i will use those two date fields in filter again like same provide below.

| where R_recon_business_date >= days90_ago AND R_recon_business_date <= yest

Thanks in advance..

This is the sample query framed ..

index=data_for_checkprod

| rename currency_val as currency_code

| join type=left currency_code [search index=currenciesss]

| eval a= (-txn_amount/100)

| eval start_date="1464235200"

| eval day_bef = relative_time("1464235200", "-1d@d" )

| eval 90days_ago = relative_time("1464235200", "-90d@d" )

| eval yesterday=strftime(day_bef, "%Y-%m-%d")

| eval ago_90days=strftime(90days_ago, "%Y-%m-%d")
| eval R_re_bis_date=substr(recon_business_date,1,10)
| where R_re_bis_date >= ago_90days AND R_re_bis_date <= yesterday
| where (like(ID, "FI72%") OR like(ID, "FI80%") OR msg ="0200" OR msg ="0420" OR tran_type = "01" )
AND pos_origin="true"

| stats sum(a) as show_data by R_re_bis_date, ID, code
| table R_re_bis_date ,ID,code,show_data