Archive
Highlighted

How to compare using eval expression and field value pair

Communicator

I want the table to be generated based on 2 conditions - one condition is comparing eval expression and other field value pair.. how to do that
index="myindex" |eval DueDateTime = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval nowtime=strftime(now(),"%d.%m.%Y")|table ID,Category | where (nowtime>=DueDateTime) AND ('System Status'!="Completed")

This where clause is not working.. please help

Tags (1)
0 Karma
Highlighted

Re: How to compare using eval expression and field value pair

Champion

i dont have logs to test this, can you check this once -

index="myindex" |eval DueDateTime = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval nowtime=strftime(now(),"%d.%m.%Y")|table ID,Category | where (nowtime>=DueDateTime) | search 'System Status'!="Completed"

or even, you can try checking the System Status at first stage itself -

index="myindex" 'System Status'!="Completed" |eval DueDateTime = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval nowtime=strftime(now(),"%d.%m.%Y")|table ID,Category | where (nowtime>=DueDateTime) 

View solution in original post

0 Karma
Highlighted

Re: How to compare using eval expression and field value pair

Communicator

Thanks for your reply.. both are not working

second one works till here.. where clause time condition not working 😞
index="myindex" "System Status"!="Completed"|eval DueDateTime = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category

0 Karma
Highlighted

Re: How to compare using eval expression and field value pair

Champion
 index="myindex" 'System Status'!="Completed"
  |eval Due_Date = strptime('Due By',"%d.%m.%Y") 
  | where (now() >= Due_Date)
  |table ID, Category
0 Karma
Highlighted

Re: How to compare using eval expression and field value pair

Communicator

It worked the way i wanted.. Thank you so much..

0 Karma
Highlighted

Re: How to compare using eval expression and field value pair

SplunkTrust
SplunkTrust

I can see two issues:

1) Your "|table ID,Category" is getting rid of some fields you are using later on such as nowtime, System Status or DueDate_Time.
2) I think this part is also going to cause you a headache as you are not comparing integers with integers, just strings with strings:

 where (now_time>=Due_Date_Time)

Can you try this instead?

index="myindex" 
|eval Due_Date_Epoch = strptime('Due By',"%d.%m.%Y")
|table ID, Category, Due_Date_Epoch, 'System Status'
| where (now() >= Due_Date_Epoch) AND ('System Status'!="Completed")

Thanks,
J

0 Karma
Highlighted

Re: How to compare using eval expression and field value pair

Communicator

Thanks for your reply. This is also not working..

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.