Splunk Search

How do I run a search with today's date in the search itself, not using the time picker?

Chambito17
Explorer

I currently have this search right now, and I apologize in advance for my poor spl. I would like to know how to run this with whatever the current date is in YYYY-MM-DD as I am trying to just get the employees leaving on the current day that ran.

| inputlookup listofemployees.csv
| search Last_Day_of_Work="$Todays Date$"
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Please let me know, thank you for your help.

Labels (2)
0 Karma
1 Solution

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

View solution in original post

Manasa_401
Communicator

Hi @Chambito17 

use can use the now() function to get the current timestamp as below.

| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")

used strftime to get the desired format.

If this helps, an upvote would be appreciated.

Thanks,

Manasa

Chambito17
Explorer

Thank you so much for the reply @Manasa_401 , but when I add that to my search it doesn't return anything. 

My csv is laid out like this

Employee_IDLast_Day_of_WorkeffectivefirstNamelastName
130XXXXX  2023-08-172023-08-18JoeShmoe
130XXXXX  2023-08-172023-08-18JohnDoe
130XXXXX  2023-08-182023-08-19JaneDoe

 

I was hoping to just see Joe and John, but I dont get anything back

| inputlookup awesome_employee.csv
| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Tags (1)
0 Karma

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

Chambito17
Explorer

Awesome, this is exactly what I needed, thank you very much @Manasa_401 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...