Compare two date

[stevesomone]

Hello,

I'd like to compare two date with this format 2011-11-30 22:21:05 for example.
If I search the following, this didn't work.
index="toto" solvedate>due_date

but if I search with this it work:
index="toto" solvedate>2011-12-15 17:21:05

What must I do for this to work ?
The date are correctly stored in the field.

Thanks in advance,

Steve

[siraj198204]

Hi ,
source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"), "%Y-%m-%d %H:%M") |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now()

output,

exp_date =2014-11-04 11:06

I am not getting the compare>now() output .

exp_date-currentdate(now()) = number of days output .... ????? i am not getting the output ..

Thank u ...

Regards,
Siraj

[joshd]

Command reference can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Functions for eval and where are here:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Remember to vote the answer as correct, dont want to leave things lingering as unanswered 🙂

[stevesomone]

Thank you for your response.

This work great.

Can we find all the function in the wiki ? Or somewhere else ?

Thanks.

Steve

[joshd · Accepted solution]

You can convert the fields to epoch values and compare that way for best results... look to use the strptime() function... ie:

eval compare=strptime(solvedate,"%Y-%m-%d %H:%M:%S") | where compare>strptime(due_date,"%Y-%m-%d %H:%M:%S")