Splunk Enterprise

how to compare the dates

renuka
Path Finder

Hello 

I have csv file below which i take refference to get a verified output by using conditions

verified column conditions:we have to consider the TC.strd2ExecutionDate as the Verifed_Date.
Verifed_Date = d2ExecutionDate
Cond 2: we get the First_Date and Second_Date from PhaseMapping file.
Eg:- R06=Tue 24 Mar 2020,Wed 10 Jun 2020
First_Date = Tue 24 Mar 2020
Second_Date = Wed 10 Jun 2020 then compare those date into the Verifed_Date

Date Compare:-
if(First_Date.before(Verifed_Date ) /second_Date.before(verified_Date)consider the value as 1,
else if(First_Date.equals(Verifed_Date )/(Second_Date=verified_Date)consider the values as 0,
else consider the r value as 2;
if D2_ExecutionDate is null or empty mean verified should be null .

a). (Date Compare(Verifed_Date ,First_Date == 0 || Verifed_Date ,First_Date == 1)
&& (Verifed_Date ,Second_Date == 2 || Verifed_Date, Second_Date == 0))
get the verified values from PhaseMapping verified = R06.1

Can you suggest me any queries for this conditions

Thank you in advance

CRS__implementation_phase First_DateSecond_Date
UPV1                   Mon 10 Sep 2018Sun 02 Dec 2018
UPV2                        Mon 03 Dec 2018Mon 18 Mar 2019
DCV0                      Tue 19 Mar 2019Thu 13 Jun 2019
DCV2                     Thu 06 Jun 2019Mon 12 Aug 2019
DCV3                    Tue 13 Aug 2019Wed 30 Oct 2019
R00                   Thu 31 Oct 2019Sun 08 Dec 2019
R04                     Mon 09 Dec 2019Thu 13 Feb 2020
R05                       Fri 14 Feb 2020Mon 23 Mar 2020
R06                      Tue 24 Mar 2020Wed 10 Jun 2020
R06.1                       Thu 11 Jun 2020   Wed 24 Jun 2020
R06.2Thu 25 Jun 2020Mon 03 Aug 2020
R06.3 Tue 04 Aug 2020Sun 30 Aug 2020
R06.4  Mon 31 Aug 2020Mon 30 Nov 2020
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Dates must be in epoch form to be compared.  Use the strptime() function to convert a date into epoch form.

... | eval eVerified_Date = strptime(Verified_Date, "%a %d %b %Y"),
eFirst_Date = strptime(First_Date, "%a %d %b %Y"),
eSecond_Date = strptime(Second_Date, "%a %d %b %Y")
| eval Compare = case(eFirst_Date < eVerified_Date, 1,
                      eFirst_Date = eVerified_Date, 0,
                      1==1, 2)
...
---
If this reply helps you, Karma would be appreciated.
0 Karma

renuka
Path Finder

Thank You for reply @richgalloway 

I tried but i can't able to get compare field 

Main can't able compare in this form (Date Compare(Verifed_Date ,First_Date == 0 || Verifed_Date ,First_Date == 1)
&& (Verifed_Date ,Second_Date == 2 || Verifed_Date, Second_Date == 0))
get the verified values from PhaseMapping verified = R06.1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't understand the pseudo-code.  Can you re-post in a different way, perhaps something python-like?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...