@yuanliu  wow, just wow, many thanks dear. code is working perfectly i really appreciate  ... View more

Hi @ositaumeozulu, good for you, see next time! Please accept one answer for the other people of Community Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

@gcusello code not working, i keep getting blanks , i want to add days to a date and get my answer in date format ... View more

Splunk cannot do much with dates in string format.  They should be converted into integers using the strptime function first.  Also, the number of days should be converted into seconds before it is added to a timestamp. | eval lastpickupts = strptime(lastpickupdate, "<<format string>>") | eval IITts = strptime(IIT, "<<format string>>") | eval SecsOfARVRefil = (DaysOfARVRefil + 28) * 86400 | eval InT = if(((lastpickupts + SecsOfARVRefil ) > IITts), "Interrupted", "Active") ... View more

Wow, many thanks @duncangoff3 you are awesome ... View more