Splunk Search

How to do operations with dates fields?

bruno_eduardo
Path Finder

Got a date field that I would like to return only events that were within a specific range, from today to 15 days in the future.
To get today:
|eval timenow=now() |eval nowstring=strftime(now(),"%d/%m/%Y %H:%M:%S")
|table nowstring
04/11/2014 10:35:59

My date field is already like this:
|table "Resolution Period"
27/01/2014 23:59:59

But when I try a simple search like this:
|where "Resolution Period" > nowstring |table "Resolution Period"
I still got all events, unfiltered. Do I need to change something on the "Resolution Period"??

And How to return only events that were within a specific range, from today to 15 days in the future.???

Thanks in advance

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi bruno_eduardo,

I would compare epoch times not human readable time stamps.

So something like this will do it:

... | eval now_time=now() 
| convert mktime("Resolution Period") AS Resolution_Period
| where Resolution_Period > now_time
| table Resolution_Period

regarding the future timestamp you can try this:

... | eval future_time=relative_time(now(), "+15d") | ...

this will return an epoch timestamp as well.

hope this helps ....

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi bruno_eduardo,

I would compare epoch times not human readable time stamps.

So something like this will do it:

... | eval now_time=now() 
| convert mktime("Resolution Period") AS Resolution_Period
| where Resolution_Period > now_time
| table Resolution_Period

regarding the future timestamp you can try this:

... | eval future_time=relative_time(now(), "+15d") | ...

this will return an epoch timestamp as well.

hope this helps ....

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...