Compare Dates and exclude event if it is older

[Noob_splunker]

Hi,

How do I compare dates and exclude the event if it is older?

I have here my table from transaction command. I want to compare the ReportedTime to Occurtime. If it is older then NeSn will be excluded.

ReportedTime	NeSn	Occurtime
2020-07-01 23:38	117629897	29/04/2020 12:03
	117629923	11/06/2020 23:26
	117629924	11/06/2020 23:26
	117629925	11/06/2020 23:26
	117629926	11/06/2020 23:26
	117629927	11/06/2020 23:26
	118106613	5/07/2020 21:30
	114218693	14/04/2020 6:32

Regards,

[DavidHourani]

Hi @Noob_splunker 

What's the query you're using to build out this table ? It seems to me that most of your fields are multi-value fields.

You're probably better off making sure that each line has a single ReportedTime and Occurtime. Once you do that you can use the answer posted by Rich to compare both timestamps.

Cheers,

David

[richgalloway]

It may be easier to exclude the events before the transaction command. For example,

| where strptime(OccurTime, "%Y-%m-%d %H:%M:%S") < strptime(ReportedTime, "%Y-%m-%d %H:%M:%S")
| transaction ...

Date strings have to be converted to integers before they can be compared.  Hence the strptime() calls.

[Noob_splunker]

Hi @richgalloway 

Thanks for your reply. I tried to add it before or after the transaction but it is still giving me the old dates.

Regards,