Hi,
I want to create automatic obsolecance reports in Splunk. I grab the info from a database. There is a collum that has the obsolecance date in it.
Now I want to compare that date with the current date when the job is run and depending on how much time is left between them they get an obso_status (12 moths or less-> obso_satus 1 and so on). The dates look like this: 2012-11-30 00:00:00.0
Does someone has suggestions on how to do this?
thx in advance
Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this
index=_internal | head 1 | eval diff=now()-_time | table _time diff
result is expressed in seconds.
If instead you want to compare a date with the current time, you have to transform it using the strptime function.
Bye.
Giuseppe
This should get you started.
| dbxquery ... | eval obso_date=strptime(obsolecanceDate, "%Y-%m-%d %H:%M:%S.%N") | eval obso_status=case((obso_date-now()) < (86400*365), 1, <so on>) | ...
Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this
index=_internal | head 1 | eval diff=now()-_time | table _time diff
result is expressed in seconds.
If instead you want to compare a date with the current time, you have to transform it using the strptime function.
Bye.
Giuseppe