Determining dates older than 90 days

[ajdyer2000]

Hi.

I have a Field called "Hire Date"
The format for this appears as "4/10/2018 12:00:00 AM"

Basically all the dates appear as 12:00 AM so that the time doesn't matter.

Question is how could you only have dates older than 90 days show up in the query?

Thanks so much
Alan D

[somesoni2]

General idea is to convert the field values (may be temporarily) to epoch format using strptime function and then compare it with current time -90 days. Splunk has function relative_time to do the later part. Try something like this

your search
| where strptime('Hir Date',"%m/%d/%Y %H:%M:%S %p")<relative_time(now(),"-90d@d")

[ajdyer2000]

That didn't seem to work. I've took out the time and now I just have the dates. I need to see only CreateDate that are over 90 days.

CreateDate
1/11/2018
8/17/2017
5/25/2018
5/10/2018
5/17/2018
5/30/2018
12/15/2010
4/23/2018

[somesoni2]

Try like this (runanywhere sample search, everything before where is just to generate sample data, replace everything before where with your search

| gentimes start=-1 | eval CreateDate="1/11/2018 8/17/2017 5/25/2018 5/10/2018 5/17/2018 5/30/2018 12/15/2010 4/23/2018" | table CreateDate | makemv CreateDate | mvexpand CreateDate 
| where strptime('CreateDate',"%m/%d/%Y")<relative_time(now(),"-90d@d")

[burakcinar]

hello ajdyer2000,

could you try this one ?

index=xxx
| eval testDate=strptime("Hire Date","%d-%m-%Y %H:%M:%S")
| where testDate < relative_time(now(),"-30d@d")

[ajdyer2000]

That didn't seem to work. I've took out the time and now I just have the dates. I need to see only CreateDate that are over 90 days.

CreateDate
1/11/2018
8/17/2017
5/25/2018
5/10/2018
5/17/2018
5/30/2018
12/15/2010
4/23/2018