Getting Data In

How to validate if the time field is within last 7 days

shaker_ali
Engager

I am trying to specify a search where it looks at the newly extracted field newdatefield and validate if it fall within last 7 days. Can any one please help, thanks.

Here is the search i have so far:
index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield=strftime( strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S"), "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| where newdatefield > SevenDaysBack | table newdatefield, SevenDaysBack

This converts and outputs the field from string to time format and gives me a baseline date. But I am stuck at validating if the date falls within last 7 days. I used splunk.answers to get the above query but somehow I'm not able to move any further.

Current Output:
newdatefield SevenDaysBack
06/02/2015 02:26:18 PM 05/27/2015 12:00:00 AM
06/02/2015 10:11:15 AM 05/27/2015 12:00:00 AM
08/16/2005 12:00:00 AM 05/27/2015 12:00:00 AM
06/02/2015 02:19:28 PM 05/27/2015 12:00:00 AM

Expected Output:
newdatefield SevenDaysBack
06/02/2015 02:26:18 PM 05/27/2015 12:00:00 AM
06/02/2015 10:11:15 AM 05/27/2015 12:00:00 AM
06/02/2015 02:19:28 PM 05/27/2015 12:00:00 AM

-S.Ali

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When comparing timestamps it's best to use epoch form rather than string form. Try this:

index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield= strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| where newdatefield > SevenDaysBack 
| eval newdatefield = strftime(newdatefield, "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| table newdatefield, SevenDaysBack
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When comparing timestamps it's best to use epoch form rather than string form. Try this:

index=application sourcetype=twoapp "0|1" earliest = -7d latest=now
| eval newdatefield= strptime( pwd_changedate, "%Y-%m-%d %H:%M:%S")
| eval SevenDaysBack = relative_time(now(), "-7d@d")
| where newdatefield > SevenDaysBack 
| eval newdatefield = strftime(newdatefield, "%m/%d/%Y %I:%M:%S %p")
| eval SevenDaysBack = strftime(SevenDaysBack ,"%m/%d/%Y %I:%M:%S %p")
| table newdatefield, SevenDaysBack
---
If this reply helps you, Karma would be appreciated.

shaker_ali
Engager

Thanks.

Didn't think of that approach. Appreciate your help. 🙂

0 Karma

stephanefotso
Motivator

Hello!
I do not see the difference betwen your Current Output and your Expected Output. Can you be more specific?

SGF
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...