topic How to filter Splunk field results by time? in Dashboards & Visualizations

How to filter Splunk field results by time?

tayvionp — Mon, 02 May 2022 20:12:07 GMT

I'm currently building a query that will pull data from today to April 26th,

the field value contains the following time format

termination_initiated (field value name) 2022-05-02T11:47:01.011-07:00 2022-05-02T11:42:10.820-07:00

I'm currently trying to convert is so that i can only get results between today and April 26th.

I've tried this piece of code with no luck

| eval terminiation_started=strptime(termination_initiated,"%Y-%m-%dT %H:%M:%S.%QZ") | where termination_started>=relative_time(now(),"-6d@d")

Re: How to filter Splunk field results by time?

richgalloway — Mon, 02 May 2022 20:45:49 GMT

The strptime format string doesn't match the example data. Try

"%Y-%m-%dT%H:%M:%S.%3N%:z"

Re: How to filter Splunk field results by time?

bowesmana — Tue, 03 May 2022 02:55:05 GMT

Aside from @richgalloway comment about format issues, if this is the real query

| eval terminiation_started=strptime(termination_initiated,"%Y-%m-%dT %H:%M:%S.%QZ") | where termination_started>=relative_time(now(),"-6d@d")

then the name 'terminiation_started' has an extra 'i', so is not the field you are using in the where clause.

Second issue: Is that example a single event containing two values of the field?

If so, then the logic will not work anyway with the changes suggested.

If it's a multivalue field then you would need something like this

| eval rt=relative_time(now(),"-6d@d") | where tonumber(max(mvmap(termination_started, if(termination_started>=rt, 1, 0))))>0

Also, is your _time field different to this termination initiation field?

Re: How to filter Splunk field results by time?

tayvionp — Tue, 03 May 2022 13:05:42 GMT

@bowesmana Thanks, the _time value is indeed different from the "termination_started" field. Also, the 2 values are the first 2 results. They aren't multi-value

Re: How to filter Splunk field results by time?

tayvionp — Thu, 05 May 2022 15:37:03 GMT

Thanks this was the needed format

Re: How to filter Splunk field results by time?

richgalloway — Thu, 05 May 2022 16:44:27 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.