<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Date compare in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Date-compare/m-p/505417#M141236</link>
    <description>&lt;P&gt;Hi, I am new to splunk so pardon me if made any mistake or asking simple questions, i&amp;nbsp; need to extract data from XML files, only when the xml parameter date is in current date and my date filed (&lt;STRONG&gt;printed-Timestramp)&lt;/STRONG&gt; is in this format&amp;nbsp; "2020-06-20T01:23:23.693-0700"&lt;/P&gt;&lt;P&gt;i tried below query now i need to pass the&amp;nbsp; XML Parameter &lt;STRONG&gt;printed-Timestramp , &lt;/STRONG&gt;please correct me for the best way to get the result&lt;STRONG&gt;&lt;BR /&gt;&lt;/STRONG&gt;&lt;BR /&gt;|&amp;nbsp;makeresults | eval substrng=strptime(substr("2020-06-20T01:23:23.693-0700",1,10),"%Y-%m-%d")| eval compare=now() | where compare&amp;lt;substrng | fields + substrng,compare&lt;BR /&gt;&lt;BR /&gt;below arethe reference of my xml file&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 24 Jun 2020 10:28:56 GMT</pubDate>
    <dc:creator>karunagaraprabh</dc:creator>
    <dc:date>2020-06-24T10:28:56Z</dc:date>
    <item>
      <title>Date compare</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Date-compare/m-p/505417#M141236</link>
      <description>&lt;P&gt;Hi, I am new to splunk so pardon me if made any mistake or asking simple questions, i&amp;nbsp; need to extract data from XML files, only when the xml parameter date is in current date and my date filed (&lt;STRONG&gt;printed-Timestramp)&lt;/STRONG&gt; is in this format&amp;nbsp; "2020-06-20T01:23:23.693-0700"&lt;/P&gt;&lt;P&gt;i tried below query now i need to pass the&amp;nbsp; XML Parameter &lt;STRONG&gt;printed-Timestramp , &lt;/STRONG&gt;please correct me for the best way to get the result&lt;STRONG&gt;&lt;BR /&gt;&lt;/STRONG&gt;&lt;BR /&gt;|&amp;nbsp;makeresults | eval substrng=strptime(substr("2020-06-20T01:23:23.693-0700",1,10),"%Y-%m-%d")| eval compare=now() | where compare&amp;lt;substrng | fields + substrng,compare&lt;BR /&gt;&lt;BR /&gt;below arethe reference of my xml file&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 24 Jun 2020 10:28:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Date-compare/m-p/505417#M141236</guid>
      <dc:creator>karunagaraprabh</dc:creator>
      <dc:date>2020-06-24T10:28:56Z</dc:date>
    </item>
    <item>
      <title>Re: Date compare</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Date-compare/m-p/505465#M141254</link>
      <description>&lt;P&gt;| makeresults | eval epoch=strptime("2020-06-20T01:23:23.693-0700","%FT%T.%3Q%z")&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&lt;A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables" target="_self"&gt;https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables&lt;/A&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;now()&amp;nbsp;&lt;/STRONG&gt;is epoch. please try this query.&lt;/P&gt;</description>
      <pubDate>Mon, 22 Jun 2020 11:43:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Date-compare/m-p/505465#M141254</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-06-22T11:43:38Z</dc:date>
    </item>
  </channel>
</rss>

