Hi
I have to create a complex SPL command (for me ;-))
In this command, I want to search a specific word which start by W10P02xx in a log file and with a date which is previous to month -2 (26 January for today)
I think we have to use a WHERE condition but after???
Is it possible ith SPL command?
Thanks a lot
Hey
The first part you can you where yourfield like W10P02xx%
The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND
thanks tiago you are champion 😉
Please don't forget to accept and upvote the answer
Yoursearch| eval time_threshold=relative_time(now(), "-2M@d") | where yourfield like "W10P02xx%" AND _time>time_threshold
You accepted your own answer. Please unaccept yours and accept my answer to the question
thanks tiago but im not sure to succeed ...........
Hey
The first part you can you where yourfield like W10P02xx%
The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND