Hello! Sup?
I've been into some trouble when comparing datetimes to strings, I know I should convert'em.
Logs I've received are in this format:
CAMPAIGN_START_TIME
00:01:05
CAMPAIGN_END_TIME
00:06:12
CAMPAIGN_DATE
04/08/2015
So, what I did, was create a datetime based on these fields:
| eval CAMPAIGN_COMPLETE_DATE = (CAMPAIGN_DATE+ " " + CAMPAIGN_START_TIME)
The thing is, I need to make splunk filter results, based on this date, not the acctual _time filter.
So I was gonna compare CAMPAIGN_COMPLETE_DATE to "Today"
| eval Today = strftime(now(), "%d/%m/%Y %H:%M:%S")
But I'm having some issues due to string comparisson to datetime.
Does anyone know how can I solve this?
Thanks in advance!
- Vinicius Guerrero
Hi vtsguerrero,
you can use strptime
on the CAMPAIGN_COMPLETE_DATE like this:
... | eval Today = strftime(now(), "%d/%m/%Y %H:%M:%S") | eval searchTime = strptime(CAMPAIGN_COMPLETE_DATE, "%d/%m/%Y %H:%M:%S") | where searchTime = Today | ...
From the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions about strptime
This function takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y.
Hope this helps ...
cheers, MuS
Hi vtsguerrero,
you can use strptime
on the CAMPAIGN_COMPLETE_DATE like this:
... | eval Today = strftime(now(), "%d/%m/%Y %H:%M:%S") | eval searchTime = strptime(CAMPAIGN_COMPLETE_DATE, "%d/%m/%Y %H:%M:%S") | where searchTime = Today | ...
From the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions about strptime
This function takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y.
Hope this helps ...
cheers, MuS
Is it possible to filter between datetimes of event date?
For example, I need to filter a window between 23:00:00 and 06:00:00 but of the current day.
Considering current day as event date, is it possible to achieve this datetime window?
Thanks in advance @ MuS ♦