Splunk Search

Check if first occurrence of event is today

wu_weidong
Path Finder

I'm trying to check if the first occurrence of an event is today using the query below. However, I keep getting result as "0", indicating that there was no match, even though some of the dates are the same.

mysearch | stats earliest(_time) as firstSeen by item | fieldformat firstSeen=strftime(firstSeen, "%d-%m-%Y") | eval today_date=strftime(now(), "%d-%m-%Y") | eval result=if(firstSeen=today_date, "1", "0")

All of my results are "0", even for entries like the one below.

item     firstSeen     today_date    result
ABC      06-12-2019    06-12-2019    0

I even tried to change the if-condition to firstSeen!=today_date just to see what happens, and my result is still all '0', even for those where the dates don't match. It doesn't seem like the if-condition is being evaluated.

What should I do?

0 Karma
1 Solution

shandr
Path Finder

Use eval instead of fieldformat.

That fieldformat command changes the appearance of the results without changing the underlying value of the field. Refer to https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Fieldformat

View solution in original post

shandr
Path Finder

Use eval instead of fieldformat.

That fieldformat command changes the appearance of the results without changing the underlying value of the field. Refer to https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Fieldformat

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...