Re: Controlling Date

minkyuk · ‎07-20-2015

Hi, I have a column of timestamp in YYYY-MM-DD format.
I'm trying to limit it by specific date, and I feel like there should be some handy way to do this.

Would anyone be able to help?

Thank you,
Jack

richgalloway · ‎07-20-2015

To limit the column to today: ... | where column="2015-07-20" | ....

---
If this reply helps you, Karma would be appreciated.

minkyuk · ‎07-20-2015

How could I use inequality?

richgalloway · ‎07-20-2015

Either where column!="2015-07-20" or where NOT column="2015-07-20".

---
If this reply helps you, Karma would be appreciated.

Controlling Date

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automating Threat Operations and Threat Hunting with Recorded Future

Keep the Learning Going with the New Best of .conf Hub

Splunk Community Badges!

Join the Conversation