Splunk Search

How to filter the events by the date field?

Builder

Hi

From the search, i get the event_date field. How can I filter the events by using the event_date field?

event_date
06/18/2014
06/20/2014
07/17/2014
...

I need the events only between 06/01/2014 - 06/31/2014. Any suggestions?

Tags (4)
0 Karma

SplunkTrust
SplunkTrust

To compare dates you have to convert them into epoch form. Something like this

... | eval firstDate = strptime("06/01/2014", "%m/%d/%Y") | eval lastDate = strptime("06/30/2014", "%m/%d/%Y") | eval thisDate = strptime(event_date, "%m/%d/%Y") | where thisDate >= firstDate AND thisDate <= lastDate | ...
---
If this reply helps you, an upvote would be appreciated.