topic Re: Comparison between Future date and current date in Splunk Search

Comparison between Future date and current date

dsiob — Fri, 09 Jun 2017 10:13:59 GMT

I have a date field 'Start Time' in csv. I have to filter if date in this field is current week date or future week date. For this I fetch '%W' of the date and current date and comparing. But if the date is future date its '%W' is coming as current week only. It is not considering future dates.

Any help will be great!

Re: Comparison between Future date and current date

richgalloway — Fri, 09 Jun 2017 12:50:13 GMT

Why not compare epoch times directly? If _time > now() then the event is in the future.

Re: Comparison between Future date and current date

twinspop — Fri, 09 Jun 2017 13:50:51 GMT

There seems to be a lot of unneeded churn in your search. Does this work for you?

your base search 
| eval InFuture=if((now()-_time)>86400,"yes","no") 
| table _time InFuture

EDIT: you could change 86400 to 0 to catch anything in the future. Or change to 604800 to catch something 1 week in the future or more.

Re: Comparison between Future date and current date

somesoni2 — Fri, 09 Jun 2017 15:05:45 GMT

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

Re: Comparison between Future date and current date

dsiob — Mon, 12 Jun 2017 06:05:17 GMT

this returns whether the difference is 1 week or not. But I have to show whether _time is in current week or not

Re: Comparison between Future date and current date

dsiob — Mon, 12 Jun 2017 06:15:22 GMT

Ohh Superb!! its working