Date field comparison

alexandrebas — Fri, 21 Jan 2022 14:05:44 GMT

I need help regarding comparise a ISO 8601 date field with a specific date.

Below is a simple example:

index=devices | table device_last_seen

Results:

device_last_seen

2022-01-21T13:09:58Z

2022-01-21T13:10:06Z

2022-01-17T14:56:00Z

2022-01-16T10:57:18Z

My goal is to show only the devices reported in the last 24h. It should be like this:

device_last_seen

2022-01-21T13:09:58Z

2022-01-21T13:10:06Z

However the search below didn´t return any results.

index=devices
| eval last24h=relative_time(now(), "-1d")
| where device_last_seen > last24h
| table device_last_seen

Thank in advance for your help.

Re: Date field comparison

richgalloway — Fri, 21 Jan 2022 16:24:26 GMT

Dates can only be compared in integer form. Use the strptime function to convert them to integers and then compare them.

index=devices | eval last24h=relative_time(now(), "-1d") | eval dls = strptime(device_last_seen, "%Y-%m-%dT%H:%M:%S%Z") | where dls > last24h | table device_last_seen

topic Re: Date field comparison in Splunk Search

Date field comparison

Re: Date field comparison