Splunk Search

Basic Query using Dates

modulussplunk
New Member

We have indexed fields like the following:

fname (a-z*)
lname (a-z*)
pdate (name_month day year)
policy ( strong or weak)

I'm able to do a query and returned all of the usernames with a strong policy (policy = 'strong').

If I try to also query for a password change date prior to May 1st (pdate > 'May 25 2019'), I get results with users that have password changes after that date.

I believe I need to somehow convert the date perhaps with the strftime function, because maybe it's not comparing the the fields as dates, but how would I do that and actually construct the query? I've read the docs and tried some copy/pastes w/o a working solution.

Thanks

Tags (1)
0 Karma

bandit
Motivator

So the first question is. Can you index pdate as your _time field?

If pdate is not indexed as the _time field i.e. primary time key you cannot use it to search with the default time picker dropdowns or search command line time modifiers. I believe you would have to convert to epoch time first etc. and then compare to current time in epoch time to do a calculation for more than 30 days. Essentially you are converting pdate to epoch time seconds a number that you can use > = or < to compare against.

For converting dates to a number see:
https://answers.splunk.com/answers/595091/converting-date-to-epoch-time.html

0 Karma

modulussplunk
New Member

Thanks rob_jordan. I should have mentioned. I don't need to search with the default time picker drop downs, but 'within' search bar itself. We feed the data daily so the default time picker drop down doesn't mean too much. We actually use the dedup command on the search bar.

But, I apologize. That link might make sense to you or others but I'm just getting started with Splunk. I'm still a bit unsure of the syntax. From my understanding, it seems like it would the search query look something like, this?

index="blah1" sourcetype="blah2" policy = "strong" mypdate > ($epoch_number_for_desired_date)| eval mypdate = strptime('mypdate', "%m %d %y")

Thank you

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...