Getting Data In

Compare/calculate with current date

Explorer

Hi,

I want to create automatic obsolecance reports in Splunk. I grab the info from a database. There is a collum that has the obsolecance date in it.
Now I want to compare that date with the current date when the job is run and depending on how much time is left between them they get an obso_status (12 moths or less-> obso_satus 1 and so on). The dates look like this: 2012-11-30 00:00:00.0

Does someone has suggestions on how to do this?
thx in advance

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this

index=_internal | head 1 | eval diff=now()-_time | table _time diff

result is expressed in seconds.

If instead you want to compare a date with the current time, you have to transform it using the strptime function.

Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

This should get you started.

| dbxquery ... | eval obso_date=strptime(obsolecanceDate, "%Y-%m-%d %H:%M:%S.%N") | eval obso_status=case((obso_date-now()) < (86400*365), 1, <so on>) | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Hi quadealexander,
if you use _time it's ery easy because timestamp is already in epochtime, so you can use something like this

index=_internal | head 1 | eval diff=now()-_time | table _time diff

result is expressed in seconds.

If instead you want to compare a date with the current time, you have to transform it using the strptime function.

Bye.
Giuseppe

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!