topic Re: How to compare using eval expression and field value pair in Splunk Search

How to compare using eval expression and field value pair

k_harini — Tue, 29 Sep 2020 11:28:19 GMT

I want the table to be generated based on 2 conditions - one condition is comparing eval expression and other field value pair.. how to do that
index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) AND ('System Status'!="Completed")

This where clause is not working.. please help

Re: How to compare using eval expression and field value pair

inventsekar — Tue, 29 Sep 2020 11:30:30 GMT

i dont have logs to test this, can you check this once -

index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) | search 'System Status'!="Completed"

or even, you can try checking the System Status at first stage itself -

index="myindex" 'System Status'!="Completed" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time)

Re: How to compare using eval expression and field value pair

k_harini — Tue, 29 Sep 2020 11:28:22 GMT

Thanks for your reply.. both are not working

second one works till here.. where clause time condition not working 😞
index="myindex" "System Status"!="Completed"|eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category

Re: How to compare using eval expression and field value pair

javiergn — Tue, 29 Sep 2020 11:30:36 GMT

I can see two issues:

1) Your "|table ID,Category" is getting rid of some fields you are using later on such as now_time, System Status or Due_Date_Time.
2) I think this part is also going to cause you a headache as you are not comparing integers with integers, just strings with strings:

 where (now_time>=Due_Date_Time)

Can you try this instead?

index="myindex" 
|eval Due_Date_Epoch = strptime('Due By',"%d.%m.%Y")
|table ID, Category, Due_Date_Epoch, 'System Status'
| where (now() >= Due_Date_Epoch) AND ('System Status'!="Completed")

Thanks,
J

Re: How to compare using eval expression and field value pair

k_harini — Thu, 20 Oct 2016 10:45:11 GMT

Thanks for your reply. This is also not working..

Re: How to compare using eval expression and field value pair

inventsekar — Thu, 20 Oct 2016 10:51:01 GMT

 index="myindex" 'System Status'!="Completed"
  |eval Due_Date = strptime('Due By',"%d.%m.%Y") 
  | where (now() >= Due_Date)
  |table ID, Category

Re: How to compare using eval expression and field value pair

k_harini — Thu, 20 Oct 2016 11:00:38 GMT

It worked the way i wanted.. Thank you so much..