All Apps and Add-ons

Get element from index with specific date format

wawanopoulos
New Member

Hi,

My index contain a column "deliveryDate" with the following format : 2015-10-08
I would build a search to get all data from my index where deliveryDate > dateNow.

I cannot user earliest and latest keyword i think because it is not the same format of date.

Could you help me please ?

0 Karma

woodcock
Esteemed Legend

Like this:

... | eval deliveryDateEpoch=strptime(deliveryDate, "%Y-%m-%d") | where  deliveryDateEpoch>now()
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...