Getting Data In

How to validate if the time field is within last 7 days

shaker_ali
Engager

I am trying to specify a search where it looks at the newly extracted field newdatefield and validate if it fall within last 7 days. Can any one please help, thanks.

Here is the search i have so far:
index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield=strftime( strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S"), "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| where newdatefield > SevenDaysBack | table newdatefield, SevenDaysBack

This converts and outputs the field from string to time format and gives me a baseline date. But I am stuck at validating if the date falls within last 7 days. I used splunk.answers to get the above query but somehow I'm not able to move any further.

Current Output:
newdatefield SevenDaysBack
06/02/2015 02:26:18 PM 05/27/2015 12:00:00 AM
06/02/2015 10:11:15 AM 05/27/2015 12:00:00 AM
08/16/2005 12:00:00 AM 05/27/2015 12:00:00 AM
06/02/2015 02:19:28 PM 05/27/2015 12:00:00 AM

Expected Output:
newdatefield SevenDaysBack
06/02/2015 02:26:18 PM 05/27/2015 12:00:00 AM
06/02/2015 10:11:15 AM 05/27/2015 12:00:00 AM
06/02/2015 02:19:28 PM 05/27/2015 12:00:00 AM

-S.Ali

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When comparing timestamps it's best to use epoch form rather than string form. Try this:

index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield= strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| where newdatefield > SevenDaysBack 
| eval newdatefield = strftime(newdatefield, "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| table newdatefield, SevenDaysBack
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When comparing timestamps it's best to use epoch form rather than string form. Try this:

index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield= strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| where newdatefield > SevenDaysBack 
| eval newdatefield = strftime(newdatefield, "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| table newdatefield, SevenDaysBack
---
If this reply helps you, Karma would be appreciated.

shaker_ali
Engager

Thanks.

Didn't think of that approach. Appreciate your help. 🙂

0 Karma

stephanefotso
Motivator

Hello!
I do not see the difference betwen your Current Output and your Expected Output. Can you be more specific?

SGF
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...