Splunk Search

How to filter the events by the date field?

kiran331
Builder

Hi

From the search, i get the event_date field. How can I filter the events by using the event_date field?

event_date
06/18/2014
06/20/2014
07/17/2014
...

I need the events only between 06/01/2014 - 06/31/2014. Any suggestions?

Tags (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To compare dates you have to convert them into epoch form. Something like this

... | eval firstDate = strptime("06/01/2014", "%m/%d/%Y") | eval lastDate = strptime("06/30/2014", "%m/%d/%Y") | eval thisDate = strptime(event_date, "%m/%d/%Y") | where thisDate >= firstDate AND thisDate <= lastDate | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...