I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.
Plan Start Time
May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM
You'll have to convert the dates to epoch form to do that.
... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")
You'll have to convert the dates to epoch form to do that.
... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")
Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.
I fugred it out . THANKS
Thanks lot
Now i have re-Written the query to have 2 columns like below.
Have to filter rows when these two matches .. can i use where or search?
Plan_Start_date , today_date
May 03 May 01
May 01 May 01
This run-anywhere query works with your original output.
| makeresults
| eval PST=
"May 01, 08:00 PM|
May 03 10:00 PM|
Apr 30 07:00 AM"
| eval PST=split(PST, "|")
| mvexpand PST
`comment("Above is just set-up.")`
| eval epoch = strptime(PST, "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d"))
| rename PST as "Plan Start Time"
| table "Plan Start Time"