Splunk Search

How do I run a search with today's date in the search itself, not using the time picker?

Chambito17
Explorer

I currently have this search right now, and I apologize in advance for my poor spl. I would like to know how to run this with whatever the current date is in YYYY-MM-DD as I am trying to just get the employees leaving on the current day that ran.

| inputlookup listofemployees.csv
| search Last_Day_of_Work="$Todays Date$"
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Please let me know, thank you for your help.

Labels (2)
0 Karma
1 Solution

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

View solution in original post

Manasa_401
Communicator

Hi @Chambito17 

use can use the now() function to get the current timestamp as below.

| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")

used strftime to get the desired format.

If this helps, an upvote would be appreciated.

Thanks,

Manasa

Chambito17
Explorer

Thank you so much for the reply @Manasa_401 , but when I add that to my search it doesn't return anything. 

My csv is laid out like this

Employee_IDLast_Day_of_WorkeffectivefirstNamelastName
130XXXXX  2023-08-172023-08-18JoeShmoe
130XXXXX  2023-08-172023-08-18JohnDoe
130XXXXX  2023-08-182023-08-19JaneDoe

 

I was hoping to just see Joe and John, but I dont get anything back

| inputlookup awesome_employee.csv
| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Tags (1)
0 Karma

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

Chambito17
Explorer

Awesome, this is exactly what I needed, thank you very much @Manasa_401 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...