topic Filter/search Rows based on Current date in Getting Data In

Filter/search Rows based on Current date

ashanka — Fri, 01 May 2020 18:27:09 GMT

I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.

Plan Start Time

May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM

Re: Filter/search Rows based on Current date

richgalloway — Fri, 01 May 2020 18:44:32 GMT

You'll have to convert the dates to epoch form to do that.

... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")

Re: Filter/search Rows based on Current date

ashanka — Fri, 01 May 2020 18:56:59 GMT

Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.

Re: Filter/search Rows based on Current date

ashanka — Wed, 30 Sep 2020 05:17:14 GMT

Now i have re-Written the query to have 2 columns like below.

Have to filter rows when these two matches .. can i use where or search?

Plan_Start_date , today_date
May 03 May 01
May 01 May 01

Re: Filter/search Rows based on Current date

richgalloway — Fri, 01 May 2020 19:23:48 GMT

This run-anywhere query works with your original output.

| makeresults 
| eval PST=
"May 01, 08:00 PM|
May 03 10:00 PM|
Apr 30 07:00 AM" 
| eval PST=split(PST, "|") 
| mvexpand PST 
`comment("Above is just set-up.")`
| eval epoch = strptime(PST, "%b %d, %H:%M %p") 
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d"))
| rename PST as "Plan Start Time"
| table "Plan Start Time"

Re: Filter/search Rows based on Current date

ashanka — Fri, 01 May 2020 19:25:13 GMT

I fugred it out . THANKS

Re: Filter/search Rows based on Current date

ashanka — Fri, 01 May 2020 19:25:27 GMT

Thanks lot