Splunk Search

How to calculate dates in my search?

ositaumeozulu
Explorer

Sorry team to bother you again, i have a code that is giving me issues

| eval InT = (strptime('LastPickupDate',"%m-%d-%Y %H:%M:%S")) + (('DaysOfARVRefil'+ 28)*86400)

| stats list(InT) by FacilityName

but the column InT is all blank, again how do i convert InT back to readable date and list them by facility names 

many thanks

osita

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @ositaumeozulu,

to have the InT date you could also use reletive_time() function (https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions), nd anyway, you have to convert the epochtime of your calculation in Human Readable format.

something like this:

| eval InT = strftime(relative_time(strptime('LastPickupDate',"%m-%d-%Y %H:%M:%S"),"+28d"),"%m-%d-%Y %H:%M:%S")

Ciao.

Giuseppe

 

View solution in original post

gcusello
Legend

Hi @ositaumeozulu,

to have the InT date you could also use reletive_time() function (https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions), nd anyway, you have to convert the epochtime of your calculation in Human Readable format.

something like this:

| eval InT = strftime(relative_time(strptime('LastPickupDate',"%m-%d-%Y %H:%M:%S"),"+28d"),"%m-%d-%Y %H:%M:%S")

Ciao.

Giuseppe

 

ositaumeozulu
Explorer

@gcusello code not working, i keep getting blanks , i want to add days to a date and get my answer in date format

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...