Splunk Search

How to filter results based on date (not _time)?

tmaltizo
Path Finder

I'm trying to filter my data results based on the following:

myDate format: yyyy-mm-dd HH:MM:SS (Ex: 2017-03-14 03:59:59)

I need to filter results where the myDate is within the last 3 months. I attempted the solution from the following post, but I get no results when there should be. https://answers.splunk.com/answers/387898/how-to-filter-a-dashboard-search-based-on-a-date-f.html

Please let me know if more info is needed. Thanks for your help in advance!
Trista

1 Solution

somesoni2
Revered Legend

From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)

your base search 
 | eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S") 
 | where myDate>=relative_time(now(),"-3mon")

View solution in original post

somesoni2
Revered Legend

From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)

your base search 
 | eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S") 
 | where myDate>=relative_time(now(),"-3mon")

tmaltizo
Path Finder

This works! Thanks so much @somesoni2!

0 Karma

somesoni2
Revered Legend

Glad it worked out for you. You can close this question by accepting this answer.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...