Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to filter results based on date (not _time)?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to filter my data results based on the following:
myDate format: yyyy-mm-dd HH:MM:SS (Ex: 2017-03-14 03:59:59)
I need to filter results where the myDate is within the last 3 months. I attempted the solution from the following post, but I get no results when there should be. https://answers.splunk.com/answers/387898/how-to-filter-a-dashboard-search-based-on-a-date-f.html
Please let me know if more info is needed. Thanks for your help in advance!
Trista
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)
your base search
| eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S")
| where myDate>=relative_time(now(),"-3mon")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From that post itself, this should be your version (assuming the field which contains string date is 'myDate'). Please ensure to have larger time range for the search as it myDate is not _time (time range only applies on _time field)
your base search
| eval myDate= strptime(myDate, "%Y-%m-%d %H:%M:%S")
| where myDate>=relative_time(now(),"-3mon")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This works! Thanks so much @somesoni2!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad it worked out for you. You can close this question by accepting this answer.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
