Splunk Search

How to filter results based on date (not _time)?

tmaltizo
Path Finder

I'm trying to filter my data results based on the following:

myDate format: yyyy-mm-dd HH:MM:SS (Ex: 2017-03-14 03:59:59)

I need to filter results where the myDate is within the last 3 months. I attempted the solution from the following post, but I get no results when there should be. https://answers.splunk.com/answers/387898/how-to-filter-a-dashboard-search-based-on-a-date-f.html

Please let me know if more info is needed. Thanks for your help in advance!
Trista

1 Solution

somesoni2
Revered Legend

From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)

your base search 
 | eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S") 
 | where myDate>=relative_time(now(),"-3mon")

View solution in original post

somesoni2
Revered Legend

From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)

your base search 
 | eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S") 
 | where myDate>=relative_time(now(),"-3mon")

tmaltizo
Path Finder

This works! Thanks so much @somesoni2!

0 Karma

somesoni2
Revered Legend

Glad it worked out for you. You can close this question by accepting this answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...