Splunk Search

Help with search of evaluated field

rodrigomarfei
Explorer

Hello,

I need a help with a search that seems very easy, but I'm unable to achieve the results I want.

The events are recieved in diferrent days, but no more than 3 days and the date is in the field event.Date.

The date format is "yyyy-mm-ddT00:00:00".

What I need is to search for all the events within the 3 days and then filter by the date.

So i've tried the following search:

index=something daysago=3
| eval dayOfSearch = strftime(relative(now(), "-2d@d"), "%Y-%m-%dT%H:%M:%S")
| search event.Date = dayOfSearch


It does not result to what I was expecting, but if I run the search replacing the variable dayOfsearch with the actual date, like "2021-09-05T00:00:00" it works.

What am I doing wrong or is that I better way to achieve this results?

 

Thank you!

Labels (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this. Need to use "where" command if you're condition references other fields instead of static values. Also, since field name contains dot/special character, it needs to be enclosed in single quotes in where/eval.

index=something daysago=3
| eval dayOfSearch = strftime(relative(now(), "-2d@d"), "%Y-%m-%dT%H:%M:%S")
| where 'event.Date' = dayOfSearch

  

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this. Need to use "where" command if you're condition references other fields instead of static values. Also, since field name contains dot/special character, it needs to be enclosed in single quotes in where/eval.

index=something daysago=3
| eval dayOfSearch = strftime(relative(now(), "-2d@d"), "%Y-%m-%dT%H:%M:%S")
| where 'event.Date' = dayOfSearch

  

rodrigomarfei
Explorer

That's it. Single quotes and where.

 

Thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try 

| where event.Date = dayOfSearch
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...