Getting Data In

How to compare date time present in a log with the date time selected from the time range picker?

New Member

I have a log, which has two time fields,

  1. _time(Log indexed time)
  2. StartDate (Date time inside the log)

When i select date range, it compares with _time.

Is there any way to compare date selected from date range with "StartDate" ?? Please help me.

0 Karma


If the StartDate reflects when the event happened, then the StartDate should be stored in _time. You need to set this up using props.conf on the indexer (unless you are using a heavy forwarder to collect the data). Splunk only uses the time that it indexed the data when it can't find any other timestamp automatically and nothing is configured in props.conf to tell it how to parse. You should read Configure timestamps and fix your data.

There is no way to easily select the StartDate range, as all searches are based on _time. However, if you search over "All Time" or a sufficiently large time period (last 90 days, perhaps?), you can filter based on StartDate. For this to work, StartDate will need to be a Unix-formatted time. It might work something like this.

| eval Start = strptime(StartDate,"%m-%d-%Y")
| where Start >=relative_time(now(),"-7d@d")

This will select events that have a StartDate within the last week. For it to work, the timerange picker will have to select all events that might have a StartDate with an appropriate time.

Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...