I have case such as :
if date is older than 5 working (eg if today is Thursday 19th, then anything older than Thursday 12th), update the Feedback column with ‘resolution needs chase’
I have field extacted and converted by this code :
|eval testTime = strptime('VTN_field_2',"%d/%m")
|eval testTime2=(strftime('testTime',"%d/%m"))
which gives epoch date testTime :
e.g
1512498600.000000
1512498600.000000
and testTime2
e.g
01/12
06/12
I think this question is already answered here https://answers.splunk.com/answers/596221/convert-field-values-eg-1512-to-date-format-unders.html
Please let us know if this is different requirement.
Use that one (as just updated) and reverse the test.
It is the same question, no different requirement .
here just "5 working days" is specified.