Help with query to notify when date is older than x amount of days

[goken]

Hi all,

I have a table called active_services.csv.
One of the fields is called Report_Date

Date value is in the following format 20220124.
The CSV file is automatically updated weekly but sometimes fails and requires manual intervention.

I need help with a query so I can setup an alert to notify me when the report date value is older than X amount of days.

Please help.

Thank you for your help in advance.

[ITWhisperer]

| eval days=floor((relative_time(now(),"@d")-strptime(report_date,"%Y%m%d"))/(60*60*24))

[gcusello]

Hi @goken,

I suppose that you are ingesting the active_services.csv in an index.

So you could run a search like this (where X=30 days):

index=your_index
| eval Diff=strptime(Report_Date,"%Y%m%d")-86400*30
| where Diff>0

 In this way, if you have results there are events outdated and you can create an alert with this search.

Ciao.

Giuseppe