Hello,
I'd like to compare two date with this format 2011-11-30 22:21:05 for example.
If I search the following, this didn't work.
index="toto" solvedate>due_date
but if I search with this it work:
index="toto" solvedate>2011-12-15 17:21:05
What must I do for this to work ?
The date are correctly stored in the field.
Thanks in advance,
Steve
You can convert the fields to epoch values and compare that way for best results... look to use the strptime() function... ie:
eval compare=strptime(solvedate,"%Y-%m-%d %H:%M:%S") | where compare>strptime(due_date,"%Y-%m-%d %H:%M:%S")
Hi ,
source="dbmon-tail://idwarehouse/idw_account" application=TFAYD [|inputlookup execSSO.csv |rename sso as owner] |eval exp_date=strftime(relative_time(strptime(lastPasswordChange,"%Y-%m-%d %H:%M:%S"),"+90d"), "%Y-%m-%d %H:%M") |eval compare=strptime(exp_date,"%Y-%m-%d %H:%M:%S") | where compare>now()
output,
exp_date =2014-11-04 11:06
I am not getting the compare>now() output .
exp_date-currentdate(now()) = number of days output .... ????? i am not getting the output ..
Thank u ...
Regards,
Siraj
Command reference can be found here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands
Functions for eval and where are here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
Remember to vote the answer as correct, dont want to leave things lingering as unanswered 🙂
Thank you for your response.
This work great.
Can we find all the function in the wiki ? Or somewhere else ?
Thanks.
Steve
You can convert the fields to epoch values and compare that way for best results... look to use the strptime() function... ie:
eval compare=strptime(solvedate,"%Y-%m-%d %H:%M:%S") | where compare>strptime(due_date,"%Y-%m-%d %H:%M:%S")