Getting Data In

How to validate if the time field is within last 7 days

shaker_ali
Engager

I am trying to specify a search where it looks at the newly extracted field newdatefield and validate if it fall within last 7 days. Can any one please help, thanks.

Here is the search i have so far:
index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield=strftime( strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S"), "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| where newdatefield > SevenDaysBack | table newdatefield, SevenDaysBack

This converts and outputs the field from string to time format and gives me a baseline date. But I am stuck at validating if the date falls within last 7 days. I used splunk.answers to get the above query but somehow I'm not able to move any further.

Current Output:
newdatefield SevenDaysBack
06/02/2015 02:26:18 PM 05/27/2015 12:00:00 AM
06/02/2015 10:11:15 AM 05/27/2015 12:00:00 AM
08/16/2005 12:00:00 AM 05/27/2015 12:00:00 AM
06/02/2015 02:19:28 PM 05/27/2015 12:00:00 AM

Expected Output:
newdatefield SevenDaysBack
06/02/2015 02:26:18 PM 05/27/2015 12:00:00 AM
06/02/2015 10:11:15 AM 05/27/2015 12:00:00 AM
06/02/2015 02:19:28 PM 05/27/2015 12:00:00 AM

-S.Ali

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When comparing timestamps it's best to use epoch form rather than string form. Try this:

index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield= strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| where newdatefield > SevenDaysBack 
| eval newdatefield = strftime(newdatefield, "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| table newdatefield, SevenDaysBack
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When comparing timestamps it's best to use epoch form rather than string form. Try this:

index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield= strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| where newdatefield > SevenDaysBack 
| eval newdatefield = strftime(newdatefield, "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| table newdatefield, SevenDaysBack
---
If this reply helps you, Karma would be appreciated.

shaker_ali
Engager

Thanks.

Didn't think of that approach. Appreciate your help. 🙂

0 Karma

stephanefotso
Motivator

Hello!
I do not see the difference betwen your Current Output and your Expected Output. Can you be more specific?

SGF
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...