topic Re: Help searching dataset with a date field in Splunk Search

Help searching dataset with a date field

solaced — Fri, 26 Nov 2021 03:51:26 GMT

Hi I'm looking to search a dataset to returns entries from yesterday's date based off a date field which has been converted as such (from another job): | eval event_time = now() | convert ctime(event_time)

The value is stored as 11/24/2021 22:28

Please assist how to search and return this value using a yesterday variable?

I hope that makes sense, forgive me I'm still learning.

To illustrate, manually entering eventDate="11/24" works, but not sure how to get a 'yesterday' to work with the dataset.

Re: Help searching dataset with a date field

PickleRick — Fri, 26 Nov 2021 05:08:46 GMT

In such case it makes sense to use a subquery. For example:

| inoutlookup your.csv | search 
 [ | makeresults 
   | eval d=now()-86400
   | eval eventDate=strftime("%i %never %remember %these",d)
   | fields eventDate ]

Re: Help searching dataset with a date field

isoutamo — Fri, 26 Nov 2021 06:59:41 GMT

Here

| eval eventDate=strftime(d, "%d/%m/%Y")

If needed you can concatenate * to end of the string.

And bookmark to that page

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

Another link to commands

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Re: Help searching dataset with a date field

PickleRick — Fri, 26 Nov 2021 07:05:28 GMT

Thanks. Had I been wrtiting this on my computer I'd surely check the timespecs. But in the morning I usually answer on my tablet while walking the dog 🙂