topic Re: How to filter results based on date (not _time)? in Splunk Search

How to filter results based on date (not _time)?

tmaltizo — Mon, 13 Mar 2017 19:54:28 GMT

I'm trying to filter my data results based on the following:

myDate format: yyyy-mm-dd HH:MM:SS (Ex: 2017-03-14 03:59:59)

I need to filter results where the myDate is within the last 3 months. I attempted the solution from the following post, but I get no results when there should be. https://answers.splunk.com/answers/387898/how-to-filter-a-dashboard-search-based-on-a-date-f.html

Please let me know if more info is needed. Thanks for your help in advance!
Trista

Re: How to filter results based on date (not _time)?

somesoni2 — Mon, 13 Mar 2017 19:59:32 GMT

From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)

your base search 
 | eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S") 
 | where myDate>=relative_time(now(),"-3mon")

Re: How to filter results based on date (not _time)?

tmaltizo — Tue, 14 Mar 2017 14:20:18 GMT

This works! Thanks so much @somesoni2!

Re: How to filter results based on date (not _time)?

somesoni2 — Tue, 14 Mar 2017 14:27:02 GMT

Glad it worked out for you. You can close this question by accepting this answer.