https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-string-to-date-query/m-p/430367#M123060 <P>Hi Community ,</P> <P>I have a question about a conversion beetwen string to date.</P> <P>I have some extract in CSV from my google platform like this : </P> <PRE><CODE>&gt; host=DSCRIPT02 sourcetype=csv:google | eval lastSync-mod=substr(lastSync,1,10) | search "lastSync-mod"!=Never AND "lastSync-mod"!=LastSync | table resourceId email lastSync-mod | sort lastSync-mod | head 20 </CODE></PRE> <P>I have the last 20 mobiles, but i want the the list of mobiles that was not sync until 30days. The problem is the field last-Sync-Mod is not recognized as a date format </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5932iDA4C81A90CBB88EB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Can you help me <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ?</P> <P>Many thanks</P> Fri, 19 Oct 2018 06:51:49 GMT serviceinfrastr 2018-10-19T06:51:49Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-string-to-date-query/m-p/430367#M123060 <P>Hi Community ,</P> <P>I have a question about a conversion beetwen string to date.</P> <P>I have some extract in CSV from my google platform like this : </P> <PRE><CODE>&gt; host=DSCRIPT02 sourcetype=csv:google | eval lastSync-mod=substr(lastSync,1,10) | search "lastSync-mod"!=Never AND "lastSync-mod"!=LastSync | table resourceId email lastSync-mod | sort lastSync-mod | head 20 </CODE></PRE> <P>I have the last 20 mobiles, but i want the the list of mobiles that was not sync until 30days. The problem is the field last-Sync-Mod is not recognized as a date format </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5932iDA4C81A90CBB88EB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Can you help me <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ?</P> <P>Many thanks</P> Fri, 19 Oct 2018 06:51:49 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-string-to-date-query/m-p/430367#M123060 serviceinfrastr 2018-10-19T06:51:49Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-string-to-date-query/m-p/430368#M123061 <P>@serviceinfrastructure,</P> <P>Try</P> <PRE><CODE>"Your search "|eval last_sync_time=strptime(lastSync-mod,"%Y-%m-%d")|eval diff=(now()-last_sync_time)/86400|where diff&gt;30 </CODE></PRE> Fri, 19 Oct 2018 14:52:29 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-string-to-date-query/m-p/430368#M123061 renjith_nair 2018-10-19T14:52:29Z