Splunk Search

How do I run a search with today's date in the search itself, not using the time picker?

Chambito17
Explorer

I currently have this search right now, and I apologize in advance for my poor spl. I would like to know how to run this with whatever the current date is in YYYY-MM-DD as I am trying to just get the employees leaving on the current day that ran.

| inputlookup listofemployees.csv
| search Last_Day_of_Work="$Todays Date$"
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Please let me know, thank you for your help.

Labels (2)
0 Karma
1 Solution

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

View solution in original post

Manasa_401
Communicator

Hi @Chambito17 

use can use the now() function to get the current timestamp as below.

| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")

used strftime to get the desired format.

If this helps, an upvote would be appreciated.

Thanks,

Manasa

Chambito17
Explorer

Thank you so much for the reply @Manasa_401 , but when I add that to my search it doesn't return anything. 

My csv is laid out like this

Employee_IDLast_Day_of_WorkeffectivefirstNamelastName
130XXXXX  2023-08-172023-08-18JoeShmoe
130XXXXX  2023-08-172023-08-18JohnDoe
130XXXXX  2023-08-182023-08-19JaneDoe

 

I was hoping to just see Joe and John, but I dont get anything back

| inputlookup awesome_employee.csv
| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Tags (1)
0 Karma

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

Chambito17
Explorer

Awesome, this is exactly what I needed, thank you very much @Manasa_401 

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...