Splunk Search

need to add 45 days in a field

vinitpathri
Path Finder

i have a field "add_time" with the values as "05-27-2020 08:57:34.024"

i want to create a field which will show 45 days ahead of the given time.
i.e output should be "07-11-2020 08:57:34.024"

please help me in writing this spl.

Thanks in advance

Labels (1)
Tags (1)
0 Karma
1 Solution

493669
Super Champion

@vinitpathri Try below-

|makeresults|eval add_time="05-27-2020 08:57:34.024"|eval new=strftime(strptime(add_time,"%m-%d-%Y %H:%M:%S.%3N")+3888000,"%m-%d-%Y %H:%M:%S.%3N")

View solution in original post

493669
Super Champion

@vinitpathri Try below-

|makeresults|eval add_time="05-27-2020 08:57:34.024"|eval new=strftime(strptime(add_time,"%m-%d-%Y %H:%M:%S.%3N")+3888000,"%m-%d-%Y %H:%M:%S.%3N")

vinitpathri
Path Finder

perfect, it worked.
thanks

0 Karma

493669
Super Champion

Please accept answer to help future readers.

0 Karma

vinitpathri
Path Finder

done
thanks again

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...