https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177761#M51093 <P>It didn't worked. is it because i am not converting the date properly in expiryDate??</P> Mon, 30 Dec 2013 07:00:33 GMT c_sahil 2013-12-30T07:00:33Z https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177759#M51091 <P>I am having a field deliveryExpiry (String type) in my log and I want to compare whether the expiry is before the current date or after.Below I am giving the sample log</P> <P>deliveryExpiry=Wed Dec 25 18:30:00 GMT 2013 deliveryNumber=110 MESSAGE=delivered</P> <P>i tried something like this </P> <P>| eval expiryDate=strptime(deliveryExpiry,"%a %b %d %H:%M:%S %Z %Y") | eval current=now() | where expiryDate&gt;strptime(current,"%a %b %d %H %M %S %Z %Y")</P> <P>but No luck.can anyone please help</P> Fri, 13 Dec 2013 09:14:08 GMT https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177759#M51091 c_sahil 2013-12-13T09:14:08Z https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177760#M51092 <P>The <CODE>now()</CODE> function returns an integer so there's no need to <CODE>strptime()</CODE> it. Using <CODE>'where expiryDate&gt;current'</CODE> should do the trick.</P> Fri, 13 Dec 2013 14:48:20 GMT https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177760#M51092 richgalloway 2013-12-13T14:48:20Z https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177761#M51093 <P>It didn't worked. is it because i am not converting the date properly in expiryDate??</P> Mon, 30 Dec 2013 07:00:33 GMT https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177761#M51093 c_sahil 2013-12-30T07:00:33Z https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177762#M51094 <P>when i tried the below query then also it didn't work..</P> <P>| eval expiryDate=strptime(deliveryExpiry,"%a %b %d %H:%M:%S %Z %Y") | eval date=strptime(deliveryExpiry,"%a %b %d %H:%M:%S %Z %Y") | where expiryDate=date</P> Mon, 30 Dec 2013 07:09:03 GMT https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177762#M51094 c_sahil 2013-12-30T07:09:03Z https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177763#M51095 <P>Have you tried replacing <CODE>'where expiryDate=date'</CODE> with <CODE>'table expiryDate,date'</CODE> to see why they don't match?</P> Mon, 30 Dec 2013 17:33:06 GMT https://community.splunk.com/t5/Splunk-Search/Conversion-from-string-to-date/m-p/177763#M51095 richgalloway 2013-12-30T17:33:06Z