Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Date displaying as a string
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a string field (publication_date) that is displaying a date in the following format YYYY/mm/dd. Ultimately I would like to display in a dashboard any logs displaying a publication_date within the last 7 days.
I suspect I am having trouble because it is a sting field and not numeric but have been unsuccessful in finding the correct syntax.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In general, you want the strptime() function to change the display format into epoch time format, and strftime() to go the other way.
However, in this case, because the ISO format you showed will sort dates into the same order, you can just change current date - 7 days into the same format and compare directly.
| eval testDate = strftime(now()-7*24*3600,"%Y/%m/%d")
| where publication_date >= testDate
Change >= to > if you want to exclude the date one week ago (ie exclude last Friday if today is Friday).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In general, you want the strptime() function to change the display format into epoch time format, and strftime() to go the other way.
However, in this case, because the ISO format you showed will sort dates into the same order, you can just change current date - 7 days into the same format and compare directly.
| eval testDate = strftime(now()-7*24*3600,"%Y/%m/%d")
| where publication_date >= testDate
Change >= to > if you want to exclude the date one week ago (ie exclude last Friday if today is Friday).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked for me. This is the part that I was missing "(now()-7*24*3600" Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@cc3658 - in real code, I'd multiply that out, but for the forum I wanted it to be obvious what the number meant.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
