topic Search and Extract date from string in Splunk Search

Search and Extract date from string

Laxman24 — Mon, 07 Jun 2021 11:52:04 GMT

Hi All,

I need some help in searching,

I have the following data :

Field1	Field2
2021-05-14X03:02:57Y	Xa
2021-05-13X05:12:13Y	Xb
2021-05-16X04:06:45Y	Xc

So, I'd like to make a search that using the current date, assuming that today is 2021-05-16,

if I run the search it shows the output

2021-05-16X04:06:45Y

so if the next day I run the search again, it will only return the 2021-05-17 data

Could someone help me on this?

Thank you so much!

Re: Search and Extract date from string

kamlesh_vaghela — Mon, 07 Jun 2021 12:01:55 GMT

@Laxman24

Can you please try this?

YOUR_SEARCH | where (strftime(now(),"%Y-%m-%d")=substr(Field1,0,10))

My Sample Search :

| makeresults |eval _raw="Field1 Field2 2021-05-14X03:02:57Y Xa 2021-05-13X05:12:13Y Xb 2021-06-07X04:06:45Y Xc" | multikv forceheader=1 | where (strftime(now(),"%Y-%m-%d")=substr(Field1,0,10))

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Search and Extract date from string

Laxman24 — Mon, 07 Jun 2021 14:14:02 GMT

Thanks @kamlesh_vaghela !!

it seems worked! Thank you!!!