Splunk Search

Compare Dates and exclude event if it is older

Explorer

Hi,

How do I compare dates and exclude the event if it is older?

I have here my table from transaction command. I want to compare the ReportedTime to Occurtime. If it is older then NeSn will be excluded.

 

exclude.png

 

ReportedTimeNeSnOccurtime

2020-07-01 23:38

117629897

29/04/2020 12:03

 

117629923

11/06/2020 23:26

 

117629924

11/06/2020 23:26

 

117629925

11/06/2020 23:26

 

117629926

11/06/2020 23:26

 

117629927

11/06/2020 23:26

 1181066135/07/2020 21:30
 11421869314/04/2020 6:32

 

Regards,

Labels (1)
Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Hi @Noob_splunker 

What's the query you're using to build out this table ? It seems to me that most of your fields are multi-value fields.

You're probably better off making sure that each line has a single ReportedTime and Occurtime. Once you do that you can use the answer posted by Rich to compare both timestamps.

Cheers,

David

SplunkTrust
SplunkTrust

It may be easier to exclude the events before the transaction command. For example,

| where strptime(OccurTime, "%Y-%m-%d %H:%M:%S") < strptime(ReportedTime, "%Y-%m-%d %H:%M:%S")
| transaction ...

Date strings have to be converted to integers before they can be compared.  Hence the strptime() calls.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Hi @richgalloway 

Thanks for your reply. I tried to add it before or after the transaction but it is still giving me the old dates.

Capture11.PNG

 

Regards,

0 Karma