Splunk Dev

How can i filter date?

mrccasi
Explorer

Hi all. I would like to ask on how can I filter a date with a format "Feb-16" "Month-Year" in search command.

Report Month

May-15
Dec-15
Jan-16
Feb-16
Mar-16
Apr-16

And the result should be Feb-16 onward.

Report Month

Feb-16
Mar-16
Apr-16

Thank you.

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

The strptime function unfortunately does not include a default to the first day of the month when extracting Mmm-yy or YYYY-MM format dates. Therefore, you have to concatenate a 01 onto the end and tell splunk that the 01 is the day.

This makes your test data...

| makeresults | eval mydate="May-15 Dec-15 Jan-16 Feb-16 Mar-16 Apr-16" | makemv mydate | mvexpand mydate

This converts it to epoch time and a display version of the epoch time...

| eval mydateEpoch=strptime(mydate."-01","%b-%y-%d")
| eval mydateDisplay=strftime(mydateEpoch,"%Y-%m-%d")

Either one of these filters for dates from Feb 2016 forward...

| where mydateDisplay>="2016-02-01"

...or...

| where mydateEpoch >= strptime("2016-02-01","%Y-%m-%d")

For efficiency reasons, you always want to filter out records as early as possible, before doing calculations, so this would be the proper order...

| makeresults | eval mydate="May-15 Dec-15 Jan-16 Feb-16 Mar-16 Apr-16" | makemv mydate | mvexpand mydate

| eval mydateEpoch=strptime(mydate."-01","%b-%y-%d")
| where mydateEpoch >= strptime("2016-02-01","%Y-%m-%d")
| eval mydateDisplay=strftime(mydateEpoch,"%Y-%m-%d")

View solution in original post

0 Karma

DalJeanis
Legend

The strptime function unfortunately does not include a default to the first day of the month when extracting Mmm-yy or YYYY-MM format dates. Therefore, you have to concatenate a 01 onto the end and tell splunk that the 01 is the day.

This makes your test data...

| makeresults | eval mydate="May-15 Dec-15 Jan-16 Feb-16 Mar-16 Apr-16" | makemv mydate | mvexpand mydate

This converts it to epoch time and a display version of the epoch time...

| eval mydateEpoch=strptime(mydate."-01","%b-%y-%d")
| eval mydateDisplay=strftime(mydateEpoch,"%Y-%m-%d")

Either one of these filters for dates from Feb 2016 forward...

| where mydateDisplay>="2016-02-01"

...or...

| where mydateEpoch >= strptime("2016-02-01","%Y-%m-%d")

For efficiency reasons, you always want to filter out records as early as possible, before doing calculations, so this would be the proper order...

| makeresults | eval mydate="May-15 Dec-15 Jan-16 Feb-16 Mar-16 Apr-16" | makemv mydate | mvexpand mydate

| eval mydateEpoch=strptime(mydate."-01","%b-%y-%d")
| where mydateEpoch >= strptime("2016-02-01","%Y-%m-%d")
| eval mydateDisplay=strftime(mydateEpoch,"%Y-%m-%d")
0 Karma

gfreitas
Builder

Is this "Report Month" text or Splunk _time? If it`s Splunk time you can use the time picker, you can also eval a new field based on _time with the epoch month and try to use a where month_epoch > epoch_base_month
Another way can be eval a new field with year + month in number and filter like 1602 (for Feb 16), 1603 (for Mar 16), 1604 (for Apr 16)

0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...