Splunk Search

How do I run a search with today's date in the search itself, not using the time picker?

Chambito17
Explorer

I currently have this search right now, and I apologize in advance for my poor spl. I would like to know how to run this with whatever the current date is in YYYY-MM-DD as I am trying to just get the employees leaving on the current day that ran.

| inputlookup listofemployees.csv
| search Last_Day_of_Work="$Todays Date$"
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Please let me know, thank you for your help.

Labels (2)
0 Karma
1 Solution

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

View solution in original post

Manasa_401
Communicator

Hi @Chambito17 

use can use the now() function to get the current timestamp as below.

| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")

used strftime to get the desired format.

If this helps, an upvote would be appreciated.

Thanks,

Manasa

Chambito17
Explorer

Thank you so much for the reply @Manasa_401 , but when I add that to my search it doesn't return anything. 

My csv is laid out like this

Employee_IDLast_Day_of_WorkeffectivefirstNamelastName
130XXXXX  2023-08-172023-08-18JoeShmoe
130XXXXX  2023-08-172023-08-18JohnDoe
130XXXXX  2023-08-182023-08-19JaneDoe

 

I was hoping to just see Joe and John, but I dont get anything back

| inputlookup awesome_employee.csv
| search Last_Day_of_Work==strftime(now(),"%Y-%m-%d")
| table Employee_ID, Last_Day_of_Work, effective, firstName, lastName

Tags (1)
0 Karma

Manasa_401
Communicator

Please replace search with where as shown below

|where year=strftime(now(),"%Y-%m-%d")

 

Chambito17
Explorer

Awesome, this is exactly what I needed, thank you very much @Manasa_401 

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...