Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to exclude events where the date greater than ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Is there a way to exclude events in a search where a specific date field (not timestamp) is greater than today. Sow i only want to see events where the specified date field is today or smaller.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try the following, which first parses the date field into a proper date/time value. Then calculates the date/time value for today and then filters events that have a date smaller or equal to today.
... your base search ...
| eval filterdate = strptime(date,"%Y-%m-%d")
| eval today = relative_time(now(),"-0d@d")
| where filterdate <= today
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try the following, which first parses the date field into a proper date/time value. Then calculates the date/time value for today and then filters events that have a date smaller or equal to today.
... your base search ...
| eval filterdate = strptime(date,"%Y-%m-%d")
| eval today = relative_time(now(),"-0d@d")
| where filterdate <= today
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Frank,
This is the answer I was looking for. I would rather exclude it in the base search but I guess with the readable time format that is not possible.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide some info on what field that date is in and how it is formatted?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The date field is in a human readable format as follows 2018-03-27 00:00:00.0, sow its YYYY-MM-DD.
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
