New field add to existing capture -- time check needed?

[mb1226]

I have an application feeding to Splunk for the better part of a couple years now. Last December we change formats and last week we added a new ticket field. We need to insure it was present going forward.

I've daily, weekly and YTD error dashboard scans , some of which are tied to alerts and reports. Mainly double checking user input for missing fields, invalid entries, inappropriate conduct, etc. For this particular field if it is missing before 5/7 it causes a false positive on the error scan. SO aside from the standard time settings , just for this field I need to check to see if the event occurred on or after 5/7 AND is the field is empty. I've a "start time" field in the format 05/07/2020 05:30:54 PM. The CMTicket field is being loaded with something in a format like "T999-999 [9999]" if anything at all. So anything BEFORE 5/7 and blank I need to block but anything on or after 5/7 and blank I need to show as an error. This will be crucial on getting the YTD to do accurate reporting of valid errors. The weekly is almost out of range and will fix itself soon.

I've done lots of dashboards, but this is a first. Any suggestions would be helpful

[richgalloway · Accepted solution]

Once you convert the start time to integer form, it's easy to compare to a certain date. For example:

... | eval cutover = strptime("05/07/2020", "%m/%d/%Y")
| eval eStartTime = strptime('start time', "%m/%d/%Y %H:%M:%S %p")
| eval CMTicketError = if (eStartTime >= cutover, isnull(CMTicket), false)
...

[mb1226]

That worked -- and is a big help - Thanks