Splunk Search

need to add 45 days in a field

vinitpathri
Path Finder

i have a field "add_time" with the values as "05-27-2020 08:57:34.024"

i want to create a field which will show 45 days ahead of the given time.
i.e output should be "07-11-2020 08:57:34.024"

please help me in writing this spl.

Thanks in advance

Tags (1)
0 Karma
1 Solution

493669
Super Champion

@vinitpathri Try below-

|makeresults|eval add_time="05-27-2020 08:57:34.024"|eval new=strftime(strptime(add_time,"%m-%d-%Y %H:%M:%S.%3N")+3888000,"%m-%d-%Y %H:%M:%S.%3N")

View solution in original post

493669
Super Champion

@vinitpathri Try below-

|makeresults|eval add_time="05-27-2020 08:57:34.024"|eval new=strftime(strptime(add_time,"%m-%d-%Y %H:%M:%S.%3N")+3888000,"%m-%d-%Y %H:%M:%S.%3N")

vinitpathri
Path Finder

perfect, it worked.
thanks

0 Karma

493669
Super Champion

Please accept answer to help future readers.

0 Karma

vinitpathri
Path Finder

done
thanks again

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...