Splunk Search

How to create a variable that contains a date X days in the past relative to now?

HattrickNZ
Motivator

I am looking to create a variable that contains a date X days in the past from now.

How do I do this?

This is a fixed date in the past:

| eval mylimit=strptime("28 may 2013","%d %b %Y") | table mylimit | 

This then converts the above to a date format that I want:

| eval mylimit2=strftime(mylimit, "%d/%m/%Y")

However, I want this to be relative to today and stored in a variable that I can use in a search.

possible related Q

Tags (3)
0 Karma
1 Solution

aladda_splunk
Splunk Employee
Splunk Employee

This might help. Toggle the # of days back in time by changing from -1 to however far back in time you want to go

| eval aaa=relative_time(now(),"-1d") | eval bbb=strftime(aaa,"%d/%m/%Y")

View solution in original post

aladda_splunk
Splunk Employee
Splunk Employee

This might help. Toggle the # of days back in time by changing from -1 to however far back in time you want to go

| eval aaa=relative_time(now(),"-1d") | eval bbb=strftime(aaa,"%d/%m/%Y")

HattrickNZ
Motivator

that works.

0 Karma

somesoni2
Revered Legend

You can use the function relative_time (available with eval and where) to get a relative date from a date field (epoch value). See this run anywhere sample)

| gentimes start=-1 |  eval SameDayLastWeek=relative_time(now(),"-1w") | eval SameDayLastMonth=relative_time(now(),"-1mon") | eval Today=now()| convert ctime(*)

HattrickNZ
Motivator

tks good to know but will got with aladda answer as it more suits my requirements.tks

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...