https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134225#M36675 <P>Your search will show 'false' if a source hasn't produced any events in the past 60 days. For most cases, your sources will be more talkative than that, right? So 'true' would be the expected result. Looking at the timestamps in the table that the search produces, does this seem to be right?</P> <P>At least I can get it to work in this fashion. However, you'll need an <CODE>OR</CODE> between the <CODE>source</CODE>s in the second element of the search query.</P> <P>/K</P> Fri, 08 Nov 2013 07:53:39 GMT kristian_kolb 2013-11-08T07:53:39Z https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134224#M36674 <P>I'm trying to compare the lastTime from a metadata search, with a relative time to now...</P> <P>Unfortunatly the comparison doesn't work, I don't understand why</P> <PRE><CODE>| metadata type=sources | search source=*kivdv.business.msg.* source=*dfi.in.log | eval now=relative_time(now(),"-60d@d") | eval last_gt_now=if(lastTime &gt; now,"true","false") | convert ctime(lastTime),ctime(now) | table lastTime,now,last_gt_now,source </CODE></PRE> <P>See screenshot, last_gt_now is always true !<IMG src="http://answers.splunk.com//storage/splunk_meta.png" alt="alt text" /></P> Mon, 28 Sep 2020 15:14:04 GMT https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134224#M36674 sbsbb 2020-09-28T15:14:04Z https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134225#M36675 <P>Your search will show 'false' if a source hasn't produced any events in the past 60 days. For most cases, your sources will be more talkative than that, right? So 'true' would be the expected result. Looking at the timestamps in the table that the search produces, does this seem to be right?</P> <P>At least I can get it to work in this fashion. However, you'll need an <CODE>OR</CODE> between the <CODE>source</CODE>s in the second element of the search query.</P> <P>/K</P> Fri, 08 Nov 2013 07:53:39 GMT https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134225#M36675 kristian_kolb 2013-11-08T07:53:39Z https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134226#M36676 <P>I'm sorry I've forgotten the screenshot... take a look at the results...</P> Fri, 08 Nov 2013 08:01:16 GMT https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134226#M36676 sbsbb 2013-11-08T08:01:16Z https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134227#M36677 <P>Running the query without the filter here gives me trues and falses correctly at the 60 day cutoff.</P> Fri, 08 Nov 2013 08:24:38 GMT https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134227#M36677 martin_mueller 2013-11-08T08:24:38Z https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134228#M36678 <P>sbsbb, yes. The screenshot shows all 'true' - as it should. All dates for last_gt_now are more recent than 60 days ago.</P> Mon, 28 Sep 2020 15:14:11 GMT https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134228#M36678 kristian_kolb 2020-09-28T15:14:11Z https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134229#M36679 <P>Your search workes fine and provides false value as well for last_gt_now if lastTime is actually less than now.</P> Mon, 28 Sep 2020 15:14:13 GMT https://community.splunk.com/t5/Splunk-Search/Error-comparing-Dates-in-Metadata-search/m-p/134229#M36679 somesoni2 2020-09-28T15:14:13Z