Splunk Search

How do I run a search with today's date in the search itself, not using the time picker?

Chambito17
Explorer

I currently have this search right now, and I apologize in advance for my poor spl. I would like to know how to run this with whatever the current date is in YYYY-MM-DD as I am trying to just get the employees leaving on the current day that ran.

| inputlookup listofemployees.csv
| search Last_Day_of_Work="$Todays Date$"
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Please let me know, thank you for your help.

Labels (2)
0 Karma
1 Solution

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

View solution in original post

Manasa_401
Communicator

Hi @Chambito17 

use can use the now() function to get the current timestamp as below.

| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")

used strftime to get the desired format.

If this helps, an upvote would be appreciated.

Thanks,

Manasa

Chambito17
Explorer

Thank you so much for the reply @Manasa_401 , but when I add that to my search it doesn't return anything. 

My csv is laid out like this

Employee_IDLast_Day_of_WorkeffectivefirstNamelastName
130XXXXX  2023-08-172023-08-18JoeShmoe
130XXXXX  2023-08-172023-08-18JohnDoe
130XXXXX  2023-08-182023-08-19JaneDoe

 

I was hoping to just see Joe and John, but I dont get anything back

| inputlookup awesome_employee.csv
| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Tags (1)
0 Karma

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

Chambito17
Explorer

Awesome, this is exactly what I needed, thank you very much @Manasa_401 

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...