Splunk Search

Comparison between Future date and current date

dsiob
Communicator

I have a date field 'Start Time' in csv. I have to filter if date in this field is current week date or future week date. For this I fetch '%W' of the date and current date and comparing. But if the date is future date its '%W' is coming as current week only. It is not considering future dates.alt text

Any help will be great!

1 Solution

somesoni2
Revered Legend

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

View solution in original post

somesoni2
Revered Legend

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

dsiob
Communicator

Ohh Superb!! its working

0 Karma

twinspop
Influencer

There seems to be a lot of unneeded churn in your search. Does this work for you?

your base search 
| eval InFuture=if((now()-_time)>86400,"yes","no") 
| table _time InFuture

EDIT: you could change 86400 to 0 to catch anything in the future. Or change to 604800 to catch something 1 week in the future or more.

dsiob
Communicator

this returns whether the difference is 1 week or not. But I have to show whether _time is in current week or not

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not compare epoch times directly? If _time > now() then the event is in the future.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...