topic Re: Eval command to display results with X days before current date in Splunk Search

How to get eval command to display results with X days before current date?

neerajs_81 — Fri, 16 Dec 2022 14:01:25 GMT

Hi All, i have a field "last_seen" which shows date in the below format . My requirement is to compare today's date against this last_seen date and show only those events which is 3 days before today's date

last_seen

2022-12-15T19:46:55Z

2022-12-14T19:46:55Z

2022-12-11T19:46:55Z

I thought of calculating first a field that shows me the date 3 days before this last_seen value and then further doing a |where condition to show me the results. I tried the below calculation but deltaDays is coming out empty as splunk shows it blank . So the formula of now()-last_seen isn't working. Reference: https://community.splunk.com/t5/Splunk-Search/Display-events-when-current-date-is-gt-30-days-from-expiration/m-p/249876

| eval deltaDays = (now() - last_seen)/86400 | where deltaDays >=3 | table last_seen deltaDays

Expected results ( given todays date is Dec 16). Show results from 3 days before

last_seen

2022-12-11T19:46:55Z

Re: Eval command to display results with X days before current date

gcusello — Fri, 16 Dec 2022 07:19:29 GMT

Hi @neerajs_81,

your approach is correct.

What's your question?

Ciao.

Giuseppe

Re: Eval command to display results with X days before current date

Manasa_401 — Fri, 16 Dec 2022 10:39:35 GMT

Hi @neerajs_81

Try converting the last_seen into epoch format
|eval e_last_seen = strptime(last_seen,"%Y-%m-%dT%H:%M:%SZ")

Later you can perform the calculations as you did

| eval deltaDays = (now() - e_last_seen)/86400 | where deltaDays >=3
| table last_seen deltaDays

If this helps karma would be appreciated.

Thanks
Manasa

Re: Eval command to display results with X days before current date

neerajs_81 — Fri, 16 Dec 2022 10:50:51 GMT

Thank you for checking. I was making a mistake in the strptime() command. Had the time format mentioned incorrectly there.
Manasa's response worked

Re: Eval command to display results with X days before current date

neerajs_81 — Fri, 16 Dec 2022 10:51:30 GMT

THANK you