Getting Data In

Filter/search Rows based on Current date

ashanka
Explorer

I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.

Plan Start Time

May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You'll have to convert the dates to epoch form to do that.

... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You'll have to convert the dates to epoch form to do that.

... | eval epoch = strptime('Plan Start Time', "%b %d, %H:%M %p")
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d")
---
If this reply helps you, Karma would be appreciated.
0 Karma

ashanka
Explorer

Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.

0 Karma

ashanka
Explorer

I fugred it out . THANKS

0 Karma

ashanka
Explorer

Thanks lot

0 Karma

ashanka
Explorer

Now i have re-Written the query to have 2 columns like below.

Have to filter rows when these two matches .. can i use where or search?

Plan_Start_date , today_date
May 03 May 01
May 01 May 01

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This run-anywhere query works with your original output.

| makeresults 
| eval PST=
"May 01, 08:00 PM|
May 03 10:00 PM|
Apr 30 07:00 AM" 
| eval PST=split(PST, "|") 
| mvexpand PST 
`comment("Above is just set-up.")`
| eval epoch = strptime(PST, "%b %d, %H:%M %p") 
| where (epoch >= relative_time(now(), "@d") AND epoch < relative_time(now(), "+1d@d"))
| rename PST as "Plan Start Time"
| table "Plan Start Time"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...