Getting Data In
Highlighted

Is there a way in which we can filter the records fetched, based on a datetime column by specifying the start and end datetimes?

New Member

I have a requirement where i have to filter the records fetched between 2 date times. How to include this filter criteria in the splunk query?

Tags (2)
0 Karma
Highlighted

Re: Is there a way in which we can filter the records fetched, based on a datetime column by specifying the start and end datetimes?

Motivator

You'll need to convert the datetime field to an epochtime filed using convert's mktime() function:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert

Do the same for your beginning and ending datetimes, and then filter using the comparison:

...your search...
| convert timeformat="%Y-%m-%d %H:%M:%S" mktime(fieldtime) as fieldepoch
| eval begintime="2014-01-01 00:00:00"
| eval endtime="2014-12-31 23:59:59"
| convert timeformat="%Y-%m-%d %H:%M:%S" mktime(begintime) as beginepoch
| convert timeformat="%Y-%m-%d %H:%M:%S" mktime(endtime) as endepoch
| where fieldepoch > beginepoch AND fieldepoch < endepoch
0 Karma
Highlighted

Re: Is there a way in which we can filter the records fetched, based on a datetime column by specifying the start and end datetimes?

SplunkTrust
SplunkTrust

Try using subsearch to set the earliest and latest for the Splunk search. Syntax of subsearch would be like this.
Syntax:

[| gentimes start=-1 | eval earliest=strptime("YourStartDateInHumanReadableFormat","FormatOfYourDate") | eval latest=strptime"YourEndDateInHumanReadableFormat","FormatOfYourDate") | table earliest,latest | format]

Usage:

your base search  .. [| gentimes start=-1 | eval earliest=strptime("YourStartDateInHumanReadableFormat","FormatOfYourDate") | eval latest=strptime"YourEndDateInHumanReadableFormat","FormatOfYourDate") | table earliest,latest | format]...| rest of the search

If using in dashboard, you can use token in place of "YourStartDateInHumanReadableFormat" and "YourEndDateInHumanReadableFormat".

0 Karma