Controlling Date

minkyuk · ‎07-20-2015

Hi, I have a column of timestamp in YYYY-MM-DD format.
I'm trying to limit it by specific date, and I feel like there should be some handy way to do this.

Would anyone be able to help?

Thank you,
Jack

richgalloway · ‎07-20-2015

To limit the column to today: ... | where column="2015-07-20" | ....

---
If this reply helps you, Karma would be appreciated.

minkyuk · ‎07-20-2015

How could I use inequality?

richgalloway · ‎07-20-2015

Either where column!="2015-07-20" or where NOT column="2015-07-20".

---
If this reply helps you, Karma would be appreciated.

Controlling Date

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automated Threat Analysis: Available in ES Premier

What’s New in Splunk AI: Volume 02

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Controlling Date

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automated Threat Analysis: Available in ES Premier

What’s New in Splunk AI: Volume 02

Best Practices: Splunk auto adjust pipeline queue