Getting Data In

Filter/search Rows based on Current date

ashanka
Explorer

I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.

Plan Start Time

May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You'll have to convert the dates to epoch form to do that.

... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You'll have to convert the dates to epoch form to do that.

... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

ashanka
Explorer

Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.

0 Karma

ashanka
Explorer

I fugred it out . THANKS

0 Karma

ashanka
Explorer

Thanks lot

0 Karma

ashanka
Explorer

Now i have re-Written the query to have 2 columns like below.

Have to filter rows when these two matches .. can i use where or search?

Plan_Start_date , today_date
May 03 May 01
May 01 May 01

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This run-anywhere query works with your original output.

| makeresults 
| eval PST=
"May 01, 08:00 PM|
May 03 10:00 PM|
Apr 30 07:00 AM" 
| eval PST=split(PST, "|") 
| mvexpand PST 
`comment("Above is just set-up.")`
| eval epoch = strptime(PST, "%b %d, %H:%M %p") 
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d"))
| rename PST as "Plan Start Time"
| table "Plan Start Time"
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!