topic date parsing in Splunk Search

date parsing

DTERM — Wed, 27 Jun 2012 17:23:56 GMT

I've got date field in a splunk log that looks like: firstOccurrence=2012/06/27 14:55:12

Splunk does not interpret this as "date" field. As far as Splunk is concerned, it is only a set of strings. What query will allow me to query for all FirstOccurance that is older then 30 days?

Thanks in advance.

Re: date parsing

Ayn — Wed, 27 Jun 2012 17:51:37 GMT

Isn't the issue here why you haven't had Splunk index this field as something it should use when timestamping events? You've asked about this in a separate thread, I think it's a better idea to carry on the discussion there.

Re: date parsing

Lowell — Wed, 27 Jun 2012 18:45:08 GMT

You could do something like this:

Assuming splunk is extracting the field "firstOccurrence" with the value "2012/06/27 14:55:12", then you can add something like this to your search:

... | eval first=strptime(firstOccurrence, "%Y/%m/%d %H:%M:%S") | where relative_time(now(), "-30d")>first

However, if this should be the timestamp of your events, then you should get that corrected. Having events indexed without a proper timestamp will create all kinds of issues long-term.

Re: date parsing

DTERM — Thu, 28 Jun 2012 18:09:28 GMT

Perfect!! Thanks so much!!