topic Re: Splunk date comparison in Splunk Search

Splunk date comparison

mcamilleri — Tue, 27 Aug 2013 11:22:27 GMT

I need to be able to search for log entries with a specific start date, which has nothing to do with _time. The format is, for example, Start_Date: 08/26/2013 4:30 PM.

I need to add a condition in my search to specify the date, but not the time. I tried strptime and strftime unsuccessfully.

For example, I tried converting start date to a string (without time) and compare it to another string:

"08/26/2013"=strftime(Start_Date, "%d/%m/%Y")

This didn't work either:

 "08/26/2013"=strftime(strptime(Start_Date "%d/%m/%Y %I:%M %p"), "%d/%m/%Y")

Any ideas how to solve this?

Re: Splunk date comparison

royimad — Mon, 28 Sep 2020 14:39:40 GMT

Use
search sourcetype="comparison" | eval existing_date=functions()
instead of comparing between 2 different dates of your search solve
evaluation function instead of equal sign, 2 different dates can not be equal try to use your existing dates to be compatible with your start_date format

Hope this will help.

Re: Splunk date comparison

kristian_kolb — Tue, 27 Aug 2013 11:42:46 GMT

If Start_Date is an extracted field you can just add it to the search in a key=value format, e.g;

host=blah sourcetype=bleh Start_Date=08/26/2013*

If it is not an extracted field, and you do not wish it to be, you can extract within the search first;

host=blah sourcetype=bleh | rex "Start_Date:\s(?<Start_Date>\S+)" | search Start_Date=06/26/2013*

Your use of strftime/strptime is not correct. Those two are functions of eval.

Hope this helps,

Re: Splunk date comparison

rturk — Tue, 27 Aug 2013 12:17:22 GMT

If you want to use comparison operators instead of just making sure the string is equal to "08/26/2013 4:30 PM" (e.g. "return all events that have a start date after 09/24/2012"), you will need to convert the time into epoch seconds.

<base search> | eval start-epoch=strptime(Start_Date, "%m/%d/%Y %I:%M %p")

This will give you a new field start-epoch that may be used for comparison purposes.

NOTE: This assumes you have a field called Start_Date. If you do not, you will need to extract the date similarly to how kristian.kolb did in the other answer provided.

Hope this helps! 🙂

References:

Re: Splunk date comparison

mcamilleri — Tue, 27 Aug 2013 12:59:54 GMT

Thanks! Start_Date=08/26/2013* works perfectly.