Splunk Search

Compare two date

stevesomone
Engager

Hello,

I'd like to compare two date with this format 2011-11-30 22:21:05 for example.
If I search the following, this didn't work.
index="toto" solvedate>due_date

but if I search with this it work:
index="toto" solvedate>2011-12-15 17:21:05

What must I do for this to work ?
The date are correctly stored in the field.

Thanks in advance,

Steve

Tags (2)
1 Solution

joshd
Builder

You can convert the fields to epoch values and compare that way for best results... look to use the strptime() function... ie:

eval compare=strptime(solvedate,"%Y-%m-%d %H:%M:%S") | where compare>strptime(due_date,"%Y-%m-%d %H:%M:%S")

View solution in original post

siraj198204
Explorer

Hi ,
source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"), "%Y-%m-%d %H:%M") |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now()

output,

exp_date =2014-11-04 11:06

I am not getting the compare>now() output .

exp_date-currentdate(now()) = number of days output .... ????? i am not getting the output ..

Thank u ...

Regards,
Siraj

0 Karma

joshd
Builder

Command reference can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Functions for eval and where are here:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Remember to vote the answer as correct, dont want to leave things lingering as unanswered 🙂

0 Karma

stevesomone
Engager

Thank you for your response.

This work great.

Can we find all the function in the wiki ? Or somewhere else ?

Thanks.

Steve

0 Karma

joshd
Builder

You can convert the fields to epoch values and compare that way for best results... look to use the strptime() function... ie:

eval compare=strptime(solvedate,"%Y-%m-%d %H:%M:%S") | where compare>strptime(due_date,"%Y-%m-%d %H:%M:%S")
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...