https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402743#M116544 <P>Can you provide some info on what field that date is in and how it is formatted?</P> Mon, 25 Jun 2018 09:41:12 GMT FrankVl 2018-06-25T09:41:12Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402742#M116543 <P>Hi,</P> <P>Is there a way to exclude events in a search where a specific date field (not timestamp) is greater than today. Sow i only want to see events where the specified date field is today or smaller. </P> Mon, 25 Jun 2018 09:30:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402742#M116543 ebruozys 2018-06-25T09:30:41Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402743#M116544 <P>Can you provide some info on what field that date is in and how it is formatted?</P> Mon, 25 Jun 2018 09:41:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402743#M116544 FrankVl 2018-06-25T09:41:12Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402744#M116545 <P>The date field is in a human readable format as follows 2018-03-27 00:00:00.0, sow its YYYY-MM-DD. </P> Mon, 25 Jun 2018 09:45:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402744#M116545 ebruozys 2018-06-25T09:45:56Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402745#M116546 <P>Try the following, which first parses the date field into a proper date/time value. Then calculates the date/time value for today and then filters events that have a date smaller or equal to today.</P> <PRE><CODE>... your base search ... | eval filterdate = strptime(date,"%Y-%m-%d") | eval today = relative_time(now(),"-0d@d") | where filterdate &lt;= today </CODE></PRE> Mon, 25 Jun 2018 11:22:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402745#M116546 FrankVl 2018-06-25T11:22:53Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402746#M116547 <P>Hi Frank,</P> <P>This is the answer I was looking for. I would rather exclude it in the base search but I guess with the readable time format that is not possible. </P> Mon, 25 Jun 2018 13:06:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-events-where-the-date-greater-than-today/m-p/402746#M116547 ebruozys 2018-06-25T13:06:14Z