https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290501#M87809 <P>Please don't forget to accept and upvote the answer</P> Mon, 26 Mar 2018 17:00:36 GMT tiagofbmm 2018-03-26T17:00:36Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290496#M87804 <P>Hi</P> <P>I have to create a complex SPL command (for me ;-))<BR /> In this command, I want to search a specific word which start by W10P02xx in a log file and with a date which is previous to month -2 (26 January for today)<BR /> I think we have to use a WHERE condition but after???<BR /> Is it possible ith SPL command?<BR /> Thanks a lot</P> Mon, 26 Mar 2018 16:20:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290496#M87804 jip31 2018-03-26T16:20:08Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290497#M87805 <P>Hey</P> <P>The first part you can you <CODE>where yourfield like W10P02xx%</CODE></P> <P>The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND</P> Tue, 29 Sep 2020 18:41:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290497#M87805 tiagofbmm 2020-09-29T18:41:54Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290498#M87806 <P>thanks tiago but im not sure to succeed ...........</P> Mon, 26 Mar 2018 16:39:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290498#M87806 jip31 2018-03-26T16:39:43Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290499#M87807 <PRE><CODE>Yoursearch| eval time_threshold=relative_time(now(), "-2M@d") | where yourfield like "W10P02xx%" AND _time&gt;time_threshold </CODE></PRE> Mon, 26 Mar 2018 16:43:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290499#M87807 tiagofbmm 2018-03-26T16:43:27Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290500#M87808 <P>thanks tiago you are champion <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Mon, 26 Mar 2018 16:59:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290500#M87808 jip31 2018-03-26T16:59:30Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290501#M87809 <P>Please don't forget to accept and upvote the answer</P> Mon, 26 Mar 2018 17:00:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290501#M87809 tiagofbmm 2018-03-26T17:00:36Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290502#M87810 <P>You accepted your own answer. Please unaccept yours and accept my answer to the question</P> Mon, 26 Mar 2018 17:09:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-complex-WHERE-condition/m-p/290502#M87810 tiagofbmm 2018-03-26T17:09:58Z