How to filter events based on event's datetime as current date?

[vtsguerrero]

Hello! Sup?
I've been into some trouble when comparing datetimes to strings, I know I should convert'em.
Logs I've received are in this format:

CAMPAIGN_START_TIME
00:01:05

CAMPAIGN_END_TIME
00:06:12

CAMPAIGN_DATE
04/08/2015

So, what I did, was create a datetime based on these fields:

| eval CAMPAIGN_COMPLETE_DATE = (CAMPAIGN_DATE+ " " + CAMPAIGN_START_TIME)

The thing is, I need to make splunk filter results, based on this date, not the acctual _time filter.
So I was gonna compare CAMPAIGN_COMPLETE_DATE to "Today"

| eval Today = strftime(now(), "%d/%m/%Y %H:%M:%S")

But I'm having some issues due to string comparisson to datetime.
Does anyone know how can I solve this?
Thanks in advance!

- Vinicius Guerrero

[MuS · Accepted solution]

Hi vtsguerrero,

you can use strptime on the CAMPAIGN_COMPLETE_DATE like this:

... | eval Today = strftime(now(), "%d/%m/%Y %H:%M:%S") | eval searchTime = strptime(CAMPAIGN_COMPLETE_DATE, "%d/%m/%Y %H:%M:%S") | where searchTime  = Today  | ...

From the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions about strptime

This function takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y.

Hope this helps ...

cheers, MuS

[vtsguerrero]

Is it possible to filter between datetimes of event date?
For example, I need to filter a window between 23:00:00 and 06:00:00 but of the current day.
Considering current day as event date, is it possible to achieve this datetime window?
Thanks in advance @ MuS ♦