How to filter Splunk field results by time?

[tayvionp]

I'm currently building a query that will pull data from today to April 26th, 

the field value contains the following time format 

termination_initiated (field value name)
2022-05-02T11:47:01.011-07:00
2022-05-02T11:42:10.820-07:00

 I'm currently trying to convert is so that i can only get results between today and April 26th.

I've tried this piece of code with no luck

| eval terminiation_started=strptime(termination_initiated,"%Y-%m-%dT %H:%M:%S.%QZ")
| where termination_started>=relative_time(now(),"-6d@d")

[bowesmana]

Aside from @richgalloway comment about format issues, if this is the real query

| eval terminiation_started=strptime(termination_initiated,"%Y-%m-%dT %H:%M:%S.%QZ")
| where termination_started>=relative_time(now(),"-6d@d")

then the name 'terminiation_started' has an extra 'i', so is not the field you are using in the where clause.

Second issue: Is that example a single event containing two values of the field?

If so, then the logic will not work anyway with the changes suggested.

If it's a multivalue field then you would need something like this

| eval rt=relative_time(now(),"-6d@d")
| where tonumber(max(mvmap(termination_started, if(termination_started>=rt, 1, 0))))>0

Also, is your _time field different to this termination initiation field? 

[tayvionp]

@bowesmana Thanks, the _time value is indeed different from the "termination_started" field. Also, the 2 values are the first 2 results. They aren't multi-value

[richgalloway · Accepted solution]

The strptime format string doesn't match the example data.  Try

"%Y-%m-%dT%H:%M:%S.%3N%:z"

[tayvionp]

Thanks this was the needed format

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.