Filter/search Rows based on Current date

[ashanka]

I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.

Plan Start Time

May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM

[richgalloway · Accepted solution]

You'll have to convert the dates to epoch form to do that.

... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")

[ashanka]

Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.

[ashanka]

I fugred it out . THANKS

[ashanka]

Thanks lot

[ashanka]

Now i have re-Written the query to have 2 columns like below.

Have to filter rows when these two matches .. can i use where or search?

Plan_Start_date , today_date
May 03 May 01
May 01 May 01

[richgalloway]

This run-anywhere query works with your original output.

| makeresults 
| eval PST=
"May 01, 08:00 PM|
May 03 10:00 PM|
Apr 30 07:00 AM" 
| eval PST=split(PST, "|") 
| mvexpand PST 
`comment("Above is just set-up.")`
| eval epoch = strptime(PST, "%b %d, %H:%M %p") 
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d"))
| rename PST as "Plan Start Time"
| table "Plan Start Time"