Splunk Search

Comparison between Future date and current date

dsiob
Communicator

I have a date field 'Start Time' in csv. I have to filter if date in this field is current week date or future week date. For this I fetch '%W' of the date and current date and comparing. But if the date is future date its '%W' is coming as current week only. It is not considering future dates.alt text

Any help will be great!

1 Solution

somesoni2
Revered Legend

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

View solution in original post

somesoni2
Revered Legend

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

dsiob
Communicator

Ohh Superb!! its working

0 Karma

twinspop
Influencer

There seems to be a lot of unneeded churn in your search. Does this work for you?

your base search 
| eval InFuture=if((now()-_time)>86400,"yes","no") 
| table _time InFuture

EDIT: you could change 86400 to 0 to catch anything in the future. Or change to 604800 to catch something 1 week in the future or more.

dsiob
Communicator

this returns whether the difference is 1 week or not. But I have to show whether _time is in current week or not

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not compare epoch times directly? If _time > now() then the event is in the future.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...