When configuring a collection, "date" and "number" are both options. I assumed that "date" would be the correct way to store a date, but it only worked for me when I used "number".
| inputlookup my_kv_lookup where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]
When I used "date", the same filter worked, but only after returning the entire collection.
| inputlookup my_kv_lookup
| where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]
Is there a way to filter a value stored in a "date" field?
Did I make a mistake on what values I put into the "my_time" field (epoch times straight from _time)?
Does it need to be accelerated?
Do you mean time when you mentioned date here? I don't think date is a field type
Please refer
https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf
It should work with time
Hope this helps
I can't find where "date" and "number" are options when creating a collection. Where do you see it?
The relative_time function returns time in epoch format (integer) so that's why "number" works better.
Do you mean time when you mentioned date here? I don't think date is a field type
Please refer
https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf
It should work with time
Hope this helps
I had looked at that document, but somehow put "date" instead of "time". It is working fine with "time" or "number".
Is there any benefit to using "time" over "number", besides indicating what the number represents?