Splunk Enterprise

how to compare the dates

renuka
Path Finder

Hello 

I have csv file below which i take refference to get a verified output by using conditions

verified column conditions:we have to consider the TC.strd2ExecutionDate as the Verifed_Date.
Verifed_Date = d2ExecutionDate
Cond 2: we get the First_Date and Second_Date from PhaseMapping file.
Eg:- R06=Tue 24 Mar 2020,Wed 10 Jun 2020
First_Date = Tue 24 Mar 2020
Second_Date = Wed 10 Jun 2020 then compare those date into the Verifed_Date

Date Compare:-
if(First_Date.before(Verifed_Date ) /second_Date.before(verified_Date)consider the value as 1,
else if(First_Date.equals(Verifed_Date )/(Second_Date=verified_Date)consider the values as 0,
else consider the r value as 2;
if D2_ExecutionDate is null or empty mean verified should be null .

a). (Date Compare(Verifed_Date ,First_Date == 0 || Verifed_Date ,First_Date == 1)
&& (Verifed_Date ,Second_Date == 2 || Verifed_Date, Second_Date == 0))
get the verified values from PhaseMapping verified = R06.1

Can you suggest me any queries for this conditions

Thank you in advance

CRS__implementation_phase First_DateSecond_Date
UPV1                   Mon 10 Sep 2018Sun 02 Dec 2018
UPV2                        Mon 03 Dec 2018Mon 18 Mar 2019
DCV0                      Tue 19 Mar 2019Thu 13 Jun 2019
DCV2                     Thu 06 Jun 2019Mon 12 Aug 2019
DCV3                    Tue 13 Aug 2019Wed 30 Oct 2019
R00                   Thu 31 Oct 2019Sun 08 Dec 2019
R04                     Mon 09 Dec 2019Thu 13 Feb 2020
R05                       Fri 14 Feb 2020Mon 23 Mar 2020
R06                      Tue 24 Mar 2020Wed 10 Jun 2020
R06.1                       Thu 11 Jun 2020   Wed 24 Jun 2020
R06.2Thu 25 Jun 2020Mon 03 Aug 2020
R06.3 Tue 04 Aug 2020Sun 30 Aug 2020
R06.4  Mon 31 Aug 2020Mon 30 Nov 2020
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Dates must be in epoch form to be compared.  Use the strptime() function to convert a date into epoch form.

... | eval eVerified_Date = strptime(Verified_Date, "%a %d %b %Y"),
eFirst_Date = strptime(First_Date, "%a %d %b %Y"),
eSecond_Date = strptime(Second_Date, "%a %d %b %Y")
| eval Compare = case(eFirst_Date < eVerified_Date, 1,
                      eFirst_Date = eVerified_Date, 0,
                      1==1, 2)
...
---
If this reply helps you, Karma would be appreciated.
0 Karma

renuka
Path Finder

Thank You for reply @richgalloway 

I tried but i can't able to get compare field 

Main can't able compare in this form (Date Compare(Verifed_Date ,First_Date == 0 || Verifed_Date ,First_Date == 1)
&& (Verifed_Date ,Second_Date == 2 || Verifed_Date, Second_Date == 0))
get the verified values from PhaseMapping verified = R06.1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't understand the pseudo-code.  Can you re-post in a different way, perhaps something python-like?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...