Getting Data In

Compare/calculate with current date

quadealexander
Explorer

Hi,

I want to create automatic obsolecance reports in Splunk. I grab the info from a database. There is a collum that has the obsolecance date in it.
Now I want to compare that date with the current date when the job is run and depending on how much time is left between them they get an obso_status (12 moths or less-> obso_satus 1 and so on). The dates look like this: 2012-11-30 00:00:00.0

Does someone has suggestions on how to do this?
thx in advance

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this

index=_internal | head 1 | eval diff=now()-_time | table _time diff

result is expressed in seconds.

If instead you want to compare a date with the current time, you have to transform it using the strptime function.

Bye.
Giuseppe

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

| dbxquery ... | eval obso_date=strptime(obsolecanceDate, "%Y-%m-%d %H:%M:%S.%N") | eval obso_status=case((obso_date-now()) < (86400*365), 1, <so on>) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this

index=_internal | head 1 | eval diff=now()-_time | table _time diff

result is expressed in seconds.

If instead you want to compare a date with the current time, you have to transform it using the strptime function.

Bye.
Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...