Splunk Search

How to edit my search to compare two dates?


I want to compare two dates using case statement
Theoretically, case( _time > "2016-01-01") . If True, Print "Yes" in New column status1

Below is the search, but I am not getting any results. Can you please help?

index="test4" sourcetype="test2" | convert timeformat="%Y-%m-%d" ctime(_time) AS c_time | eval status1 = case(c_time < strptime(strptime("2016-01-01","%Y-%m-%d"),"%Y-%m-%d") , "Yes") |table _time, c_time,  Status1 , Name, Rank

Note: I'm using strptime twice to convey from epoch.

0 Karma


I am assuming when you are comparing greater than or less than you mean epochNumber of _time is greater/less than epoch number of "2016-01-01". Give this a try please and adjust greater than or less than according to your like in eval status1 command:

yourBaseSearch to get the _time
|eval myNewTime=strptime("2016-01-01", "%Y-%m-%d")
| eval time1=strftime(_time, "%Y-%m-%d")
| eval epoch_time=strptime( time1, "%Y-%m-%d")
| eval status1=case( epoch_time < myNewTime, "Yes", 1=1, "No" )
| table _time, epoch_time, myNewTime, status1, Name, Rank
0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...