Splunk Search

need to add 45 days in a field

vinitpathri
Path Finder

i have a field "add_time" with the values as "05-27-2020 08:57:34.024"

i want to create a field which will show 45 days ahead of the given time.
i.e output should be "07-11-2020 08:57:34.024"

please help me in writing this spl.

Thanks in advance

Labels (1)
Tags (1)
0 Karma
1 Solution

493669
Super Champion

@vinitpathri Try below-

|makeresults|eval add_time="05-27-2020 08:57:34.024"|eval new=strftime(strptime(add_time,"%m-%d-%Y %H:%M:%S.%3N")+3888000,"%m-%d-%Y %H:%M:%S.%3N")

View solution in original post

493669
Super Champion

@vinitpathri Try below-

|makeresults|eval add_time="05-27-2020 08:57:34.024"|eval new=strftime(strptime(add_time,"%m-%d-%Y %H:%M:%S.%3N")+3888000,"%m-%d-%Y %H:%M:%S.%3N")

vinitpathri
Path Finder

perfect, it worked.
thanks

0 Karma

493669
Super Champion

Please accept answer to help future readers.

0 Karma

vinitpathri
Path Finder

done
thanks again

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...