Splunk Enterprise

how to compare the dates

renuka
Path Finder

Hello 

I have csv file below which i take refference to get a verified output by using conditions

verified column conditions:we have to consider the TC.strd2ExecutionDate as the Verifed_Date.
Verifed_Date = d2ExecutionDate
Cond 2: we get the First_Date and Second_Date from PhaseMapping file.
Eg:- R06=Tue 24 Mar 2020,Wed 10 Jun 2020
First_Date = Tue 24 Mar 2020
Second_Date = Wed 10 Jun 2020 then compare those date into the Verifed_Date

Date Compare:-
if(First_Date.before(Verifed_Date ) /second_Date.before(verified_Date)consider the value as 1,
else if(First_Date.equals(Verifed_Date )/(Second_Date=verified_Date)consider the values as 0,
else consider the r value as 2;
if D2_ExecutionDate is null or empty mean verified should be null .

a). (Date Compare(Verifed_Date ,First_Date == 0 || Verifed_Date ,First_Date == 1)
&& (Verifed_Date ,Second_Date == 2 || Verifed_Date, Second_Date == 0))
get the verified values from PhaseMapping verified = R06.1

Can you suggest me any queries for this conditions

Thank you in advance

CRS__implementation_phase First_DateSecond_Date
UPV1                   Mon 10 Sep 2018Sun 02 Dec 2018
UPV2                        Mon 03 Dec 2018Mon 18 Mar 2019
DCV0                      Tue 19 Mar 2019Thu 13 Jun 2019
DCV2                     Thu 06 Jun 2019Mon 12 Aug 2019
DCV3                    Tue 13 Aug 2019Wed 30 Oct 2019
R00                   Thu 31 Oct 2019Sun 08 Dec 2019
R04                     Mon 09 Dec 2019Thu 13 Feb 2020
R05                       Fri 14 Feb 2020Mon 23 Mar 2020
R06                      Tue 24 Mar 2020Wed 10 Jun 2020
R06.1                       Thu 11 Jun 2020   Wed 24 Jun 2020
R06.2Thu 25 Jun 2020Mon 03 Aug 2020
R06.3 Tue 04 Aug 2020Sun 30 Aug 2020
R06.4  Mon 31 Aug 2020Mon 30 Nov 2020
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Dates must be in epoch form to be compared.  Use the strptime() function to convert a date into epoch form.

... | eval eVerified_Date = strptime(Verified_Date, "%a %d %b %Y"),
eFirst_Date = strptime(First_Date, "%a %d %b %Y"),
eSecond_Date = strptime(Second_Date, "%a %d %b %Y")
| eval Compare = case(eFirst_Date < eVerified_Date, 1,
                      eFirst_Date = eVerified_Date, 0,
                      1==1, 2)
...
---
If this reply helps you, Karma would be appreciated.
0 Karma

renuka
Path Finder

Thank You for reply @richgalloway 

I tried but i can't able to get compare field 

Main can't able compare in this form (Date Compare(Verifed_Date ,First_Date == 0 || Verifed_Date ,First_Date == 1)
&& (Verifed_Date ,Second_Date == 2 || Verifed_Date, Second_Date == 0))
get the verified values from PhaseMapping verified = R06.1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't understand the pseudo-code.  Can you re-post in a different way, perhaps something python-like?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...